Skip to content

Commit ace7482

Browse files
authored
fix(offline-download): block cloud metadata endpoints (#2487)
1 parent eadf03a commit ace7482

13 files changed

Lines changed: 69 additions & 46 deletions

File tree

internal/net/serve.go

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"fmt"
88
"io"
99
"mime/multipart"
10+
gonet "net"
1011
"net/http"
1112
"strconv"
1213
"strings"
@@ -292,6 +293,31 @@ func NewHttpClient() *http.Client {
292293

293294
return &http.Client{
294295
Timeout: time.Hour * 48,
295-
Transport: transport,
296+
Transport: &safeTransport{base: transport},
296297
}
297298
}
299+
300+
type safeTransport struct {
301+
base http.RoundTripper
302+
}
303+
304+
func (t *safeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
305+
host := req.URL.Hostname()
306+
addrs, err := gonet.DefaultResolver.LookupIPAddr(req.Context(), host)
307+
if err != nil || len(addrs) == 0 {
308+
return nil, errors.Wrapf(err, "failed to resolve host: %s", host)
309+
}
310+
for _, addr := range addrs {
311+
if isCloudMetadataIP(addr.IP) {
312+
return nil, ErrCloudMetadataEndpoint
313+
}
314+
}
315+
return t.base.RoundTrip(req)
316+
}
317+
318+
var ErrCloudMetadataEndpoint = errors.New("access to cloud metadata endpoint is not allowed")
319+
320+
func isCloudMetadataIP(ip gonet.IP) bool {
321+
ip = ip.To4()
322+
return ip != nil && ip[0] == 169 && ip[1] == 254 && ip[2] == 169 && ip[3] == 254
323+
}

internal/offline_download/115/client.go

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,18 +62,16 @@ func (p *Cloud115) AddURL(args *tool.AddUrlArgs) (string, error) {
6262
return "", fmt.Errorf("unsupported storage driver for offline download, only 115 Cloud is supported")
6363
}
6464

65-
ctx := context.Background()
66-
67-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
65+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
6866
return "", err
6967
}
7068

71-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
69+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
7270
if err != nil {
7371
return "", err
7472
}
7573

76-
hashs, err := driver115.OfflineDownload(ctx, []string{args.Url}, parentDir)
74+
hashs, err := driver115.OfflineDownload(args.Ctx, []string{args.Url}, parentDir)
7775
if err != nil || len(hashs) < 1 {
7876
return "", fmt.Errorf("failed to add offline download task: %w", err)
7977
}

internal/offline_download/115_open/client.go

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,18 +58,16 @@ func (o *Open115) AddURL(args *tool.AddUrlArgs) (string, error) {
5858
return "", fmt.Errorf("unsupported storage driver for offline download, only 115 Cloud is supported")
5959
}
6060

61-
ctx := context.Background()
62-
63-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
61+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
6462
return "", err
6563
}
6664

67-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
65+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
6866
if err != nil {
6967
return "", err
7068
}
7169

72-
hashs, err := driver115Open.OfflineDownload(ctx, []string{args.Url}, parentDir)
70+
hashs, err := driver115Open.OfflineDownload(args.Ctx, []string{args.Url}, parentDir)
7371
if err != nil || len(hashs) < 1 {
7472
return "", fmt.Errorf("failed to add offline download task: %w", err)
7573
}

internal/offline_download/123/client.go

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,14 @@ func (*Pan123) AddURL(args *tool.AddUrlArgs) (string, error) {
5858
if !ok {
5959
return "", fmt.Errorf("unsupported storage driver for offline download, only 123Pan is supported")
6060
}
61-
ctx := context.Background()
62-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
61+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
6362
return "", err
6463
}
65-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
64+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
6665
if err != nil {
6766
return "", err
6867
}
69-
taskID, err := driver123.OfflineDownload(ctx, args.Url, parentDir)
68+
taskID, err := driver123.OfflineDownload(args.Ctx, args.Url, parentDir)
7069
if err != nil {
7170
return "", fmt.Errorf("failed to add offline download task: %w", err)
7271
}

internal/offline_download/123_open/client.go

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,16 +56,15 @@ func (*Open123) AddURL(args *tool.AddUrlArgs) (string, error) {
5656
if !ok {
5757
return "", fmt.Errorf("unsupported storage driver for offline download, only 123 Open is supported")
5858
}
59-
ctx := context.Background()
60-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
59+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
6160
return "", err
6261
}
63-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
62+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
6463
if err != nil {
6564
return "", err
6665
}
6766
cb := setting.GetStr(conf.Pan123OpenOfflineDownloadCallbackUrl)
68-
taskID, err := driver123Open.OfflineDownload(ctx, args.Url, parentDir, cb)
67+
taskID, err := driver123Open.OfflineDownload(args.Ctx, args.Url, parentDir, cb)
6968
if err != nil {
7069
return "", fmt.Errorf("failed to add offline download task: %w", err)
7170
}

internal/offline_download/http/client.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@ import (
1111

1212
"github.com/OpenListTeam/OpenList/v4/drivers/base"
1313
"github.com/OpenListTeam/OpenList/v4/internal/model"
14+
"github.com/OpenListTeam/OpenList/v4/internal/net"
1415
"github.com/OpenListTeam/OpenList/v4/internal/offline_download/tool"
1516
"github.com/OpenListTeam/OpenList/v4/pkg/http_range"
1617
"github.com/OpenListTeam/OpenList/v4/pkg/utils"
1718
)
1819

1920
type SimpleHttp struct {
20-
client http.Client
2121
}
2222

2323
func (s SimpleHttp) Name() string {
@@ -62,7 +62,7 @@ func (s SimpleHttp) Run(task *tool.DownloadTask) error {
6262
if streamPut {
6363
req.Header.Set("Range", "bytes=0-")
6464
}
65-
resp, err := s.client.Do(req)
65+
resp, err := net.HttpClient().Do(req)
6666
if err != nil {
6767
return err
6868
}

internal/offline_download/pikpak/pikpak.go

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,18 +63,16 @@ func (p *PikPak) AddURL(args *tool.AddUrlArgs) (string, error) {
6363
return "", fmt.Errorf("unsupported storage driver for offline download, only Pikpak is supported")
6464
}
6565

66-
ctx := context.Background()
67-
68-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
66+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
6967
return "", err
7068
}
7169

72-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
70+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
7371
if err != nil {
7472
return "", err
7573
}
7674

77-
t, err := pikpakDriver.OfflineDownload(ctx, args.Url, parentDir, "")
75+
t, err := pikpakDriver.OfflineDownload(args.Ctx, args.Url, parentDir, "")
7876
if err != nil {
7977
return "", fmt.Errorf("failed to add offline download task: %w", err)
8078
}

internal/offline_download/thunder/thunder.go

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -64,18 +64,16 @@ func (t *Thunder) AddURL(args *tool.AddUrlArgs) (string, error) {
6464
return "", fmt.Errorf("unsupported storage driver for offline download, only Thunder is supported")
6565
}
6666

67-
ctx := context.Background()
68-
69-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
67+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
7068
return "", err
7169
}
7270

73-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
71+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
7472
if err != nil {
7573
return "", err
7674
}
7775

78-
task, err := thunderDriver.OfflineDownload(ctx, args.Url, parentDir, "")
76+
task, err := thunderDriver.OfflineDownload(args.Ctx, args.Url, parentDir, "")
7977
if err != nil {
8078
return "", fmt.Errorf("failed to add offline download task: %w", err)
8179
}

internal/offline_download/thunder_browser/thunder_browser.go

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -63,23 +63,21 @@ func (t *ThunderBrowser) AddURL(args *tool.AddUrlArgs) (string, error) {
6363
return "", err
6464
}
6565

66-
ctx := context.Background()
67-
68-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
66+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
6967
return "", err
7068
}
7169

72-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
70+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
7371
if err != nil {
7472
return "", err
7573
}
7674

7775
var task *thunder_browser.OfflineTask
7876
switch v := storage.(type) {
7977
case *thunder_browser.ThunderBrowser:
80-
task, err = v.OfflineDownload(ctx, args.Url, parentDir, "")
78+
task, err = v.OfflineDownload(args.Ctx, args.Url, parentDir, "")
8179
case *thunder_browser.ThunderBrowserExpert:
82-
task, err = v.OfflineDownload(ctx, args.Url, parentDir, "")
80+
task, err = v.OfflineDownload(args.Ctx, args.Url, parentDir, "")
8381
default:
8482
return "", fmt.Errorf("unsupported storage driver for offline download, only ThunderBrowser is supported")
8583
}

internal/offline_download/thunderx/thunderx.go

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,18 +58,16 @@ func (t *ThunderX) AddURL(args *tool.AddUrlArgs) (string, error) {
5858
return "", fmt.Errorf("unsupported storage driver for offline download, only ThunderX is supported")
5959
}
6060

61-
ctx := context.Background()
62-
63-
if err := op.MakeDir(ctx, storage, actualPath); err != nil {
61+
if err := op.MakeDir(args.Ctx, storage, actualPath); err != nil {
6462
return "", err
6563
}
6664

67-
parentDir, err := op.GetUnwrap(ctx, storage, actualPath)
65+
parentDir, err := op.GetUnwrap(args.Ctx, storage, actualPath)
6866
if err != nil {
6967
return "", err
7068
}
7169

72-
task, err := thunderXDriver.OfflineDownload(ctx, args.Url, parentDir, "")
70+
task, err := thunderXDriver.OfflineDownload(args.Ctx, args.Url, parentDir, "")
7371
if err != nil {
7472
return "", fmt.Errorf("failed to add offline download task: %w", err)
7573
}

0 commit comments

Comments
 (0)