File tree Expand file tree Collapse file tree
main/java/dev/aikido/agent_api/vulnerabilities/ssrf
test/java/vulnerabilities/ssrf Expand file tree Collapse file tree Original file line number Diff line number Diff line change 66public final class RequestToServiceHostnameChecker {
77 // Pattern allows alphanumerical input (case-insensitive), dashes (-) and underscores (_)
88 private static final Pattern SERVICE_HOSTNAME_PATTERN = Pattern .compile ("^[a-zA-Z0-9-_]+$" );
9- private static final List ALLOWED_LOCALHOST_VARIANTS = List .of ("localhost" );
9+ private static final List ALLOWED_LOCALHOST_VARIANTS = List .of (
10+ "localhost" , "localdomain"
11+ );
1012
1113 public static boolean isRequestToServiceHostname (String hostname ) {
1214 if (hostname == null ) {
Original file line number Diff line number Diff line change @@ -64,6 +64,13 @@ void testAllowedLocalhostVariants() {
6464 assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("localhost.localdomain" ));
6565 assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("LOCALHOST" ));
6666 assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("LocalHost" ));
67+
68+ assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("Host.docker.Internal" ));
69+ assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("host.docker.internal" ));
70+ assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("kubernetes.docker.internal" ));
71+ assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("KUBERNETES.DOCKER.INTERNAL" ));
72+
73+ assertFalse (RequestToServiceHostnameChecker .isRequestToServiceHostname ("localdomain" ));
6774 }
6875
6976 @ Test
You can’t perform that action at this time.
0 commit comments