Function safeHTTPClient

apis/record_auth_with_oauth2.go:437–478

------------------------------------------------------------------- safeHTTPClient initializes a custom http.Client with extra host checks to prevent internal network probing requests (aka. disallow loopback, private, multicast, etc. requests). NB! The host checks are not perfect and there are prob

()

//
// @todo Evaluate with the refactoring if worth exporting(+tests) and moving under the security package.
func safeHTTPClient() *http.Client {
	dialer := &net.Dialer{
		// the same options as in http.DefaultTransport.DialContext
		Timeout:   30 * time.Second,
		KeepAlive: 30 * time.Second,

		// check the address right after estrablishing the connection to prevent dns rebinding
		Control: func(network, address string, c syscall.RawConn) error {
			host, _, err := net.SplitHostPort(address)
			if err != nil {
				return err
			}

			ip := net.ParseIP(host)

			if ip == nil ||
				ip.IsLoopback() ||
				ip.IsUnspecified() ||
				ip.IsPrivate() ||
				ip.IsLinkLocalUnicast() ||
				ip.IsLinkLocalMulticast() ||
				ip.IsMulticast() {
				return fmt.Errorf("address %q is invalid or resolve to disallowed IP", address)
			}

			return nil
		},
	}

	return &http.Client{
		Timeout: 180 * time.Second, // can be still cancelled with the request context
		Transport: &http.Transport{
			DialContext: dialer.DialContext,
			// the same options as in http.DefaultTransport
			ForceAttemptHTTP2:     true,
			MaxIdleConns:          100,
			IdleConnTimeout:       90 * time.Second,
			TLSHandshakeTimeout:   10 * time.Second,
			ExpectContinueTimeout: 1 * time.Second,
		},
	}
}

// safeFileFromURL downloads the file from the specified url (using safeHTTPClient)
// and creates a new filesystem.File value from its content (limited to DefaultMaxBodySize).