Class SafeHTTPAdapter

apps/oss/serializers/file.py:172–216

安全的 HTTP 适配器，防止 DNS 重绑定攻击 在建立连接前验证目标 IP 地址

class SafeHTTPAdapter(HTTPAdapter):
    """
    安全的 HTTP 适配器，防止 DNS 重绑定攻击
    在建立连接前验证目标 IP 地址
    """

    def send(self, request, **kwargs):
        # 解析 URL 获取主机名
        parsed_url = urlparse(request.url)
        host = parsed_url.hostname

        if host:
            # 验证目标 IP 是否安全
            self._validate_host_ip(host)

        return super().send(request, **kwargs)

    def _validate_host_ip(self, host: str):
        """验证主机解析的 IP 地址是否安全"""
        try:
            # 获取所有 IP 地址（包括 IPv4 和 IPv6）
            addr_infos = socket.getaddrinfo(host, None, socket.AF_UNSPEC, socket.SOCK_STREAM)

            for addr_info in addr_infos:
                ip = addr_info[4][0]
                if self._is_unsafe_ip(ip):
                    raise AppApiException(500, _('Access to internal IP addresses is blocked'))
        except AppApiException:
            raise
        except Exception as e:
            raise AppApiException(500, _('Failed to resolve host: {error}').format(error=str(e)))

    def _is_unsafe_ip(self, ip: str) -> bool:
        """检查 IP 地址是否属于不安全的范围"""
        try:
            ip_addr = ipaddress.ip_address(ip)
            return (
                    ip_addr.is_private or
                    ip_addr.is_loopback or
                    ip_addr.is_reserved or
                    ip_addr.is_link_local or
                    ip_addr.is_multicast
            )
        except Exception:
            return True


def get_url_content(url, application_id: str):