Skip to content

Commit 5b0b3de

Browse files
committed
Add localdomain and extra test cases
1 parent f9918eb commit 5b0b3de

2 files changed

Lines changed: 10 additions & 1 deletion

File tree

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/ssrf/RequestToServiceHostnameChecker.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@
66
public final class RequestToServiceHostnameChecker {
77
// Pattern allows alphanumerical input (case-insensitive), dashes (-) and underscores (_)
88
private static final Pattern SERVICE_HOSTNAME_PATTERN = Pattern.compile("^[a-zA-Z0-9-_]+$");
9-
private static final List ALLOWED_LOCALHOST_VARIANTS = List.of("localhost");
9+
private static final List ALLOWED_LOCALHOST_VARIANTS = List.of(
10+
"localhost", "localdomain"
11+
);
1012

1113
public static boolean isRequestToServiceHostname(String hostname) {
1214
if (hostname == null) {

agent_api/src/test/java/vulnerabilities/ssrf/RequestToServiceHostnameCheckerTest.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,13 @@ void testAllowedLocalhostVariants() {
6464
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("localhost.localdomain"));
6565
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("LOCALHOST"));
6666
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("LocalHost"));
67+
68+
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("Host.docker.Internal"));
69+
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("host.docker.internal"));
70+
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("kubernetes.docker.internal"));
71+
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("KUBERNETES.DOCKER.INTERNAL"));
72+
73+
assertFalse(RequestToServiceHostnameChecker.isRequestToServiceHostname("localdomain"));
6774
}
6875

6976
@Test

0 commit comments

Comments
 (0)