Merge pull request #908 from elhoim/fix/html-to-markdown-ssrf-blocked-ranges

[critical] fix: [html_to_markdown] block unspecified, shared, ULA and link-local ranges in the URL safety check

Author: adulau

misp_modules/modules/expansion/html_to_markdown.py

@@ -28,12 +28,17 @@
 
 
 BLOCKED_RANGES = [
+    ipaddress.ip_network("0.0.0.0/8"),
     ipaddress.ip_network("127.0.0.0/8"),
     ipaddress.ip_network("10.0.0.0/8"),
+    ipaddress.ip_network("100.64.0.0/10"),
     ipaddress.ip_network("172.16.0.0/12"),
     ipaddress.ip_network("192.168.0.0/16"),
     ipaddress.ip_network("169.254.0.0/16"),
+    ipaddress.ip_network("::/128"),
     ipaddress.ip_network("::1/128"),
+    ipaddress.ip_network("fc00::/7"),
+    ipaddress.ip_network("fe80::/10"),
 ]
 MAX_REDIRECTS = 10
 

tests/test_html_to_markdown.py

@@ -43,6 +43,29 @@ def test_blocks_hostnames_resolving_to_ipv4_mapped_blocked_addresses(self):
         ):
             self.assertFalse(is_safe_url("http://example.test/"))
 
+    def test_blocks_unspecified_shared_ula_and_link_local_literals(self):
+        blocked_urls = (
+            "http://0.0.0.0/",
+            "http://100.64.0.1/",
+            "http://[::]/",
+            "http://[fc00::1]/",
+            "http://[fd12:3456::1]/",
+            "http://[fe80::1]/",
+            "http://[::ffff:0.0.0.0]/",
+            "http://[::ffff:100.64.0.1]/",
+        )
+
+        for url in blocked_urls:
+            with self.subTest(url=url):
+                self.assertFalse(is_safe_url(url))
+
+    def test_blocks_hostnames_resolving_to_ula_addresses(self):
+        with patch(
+            "misp_modules.modules.expansion.html_to_markdown.socket.getaddrinfo",
+            return_value=[(None, None, None, None, ("fd00::1", 0, 0, 0))],
+        ):
+            self.assertFalse(is_safe_url("http://example.test/"))
+
     def test_rejects_url_without_hostname(self):
         self.assertFalse(is_safe_url("http:///missing-host"))