Skip to content

Commit 6924183

Browse files
committed
Document fedify lookup private-address behavior
Update CHANGES.md with the 2.1.6 entry for the regression fix, and rewrite the -p/--allow-private-address section in docs/cli.md to reflect that URLs given on the command line always allow private addresses while the option gates URLs discovered via --traverse or --recurse. #696 #698 Assisted-by: Claude Code:claude-opus-4-7
1 parent 8cd14c9 commit 6924183

2 files changed

Lines changed: 37 additions & 7 deletions

File tree

CHANGES.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,22 @@ Version 2.1.6
88

99
To be released.
1010

11+
### @fedify/cli
12+
13+
- Fixed `fedify lookup` failing to look up URLs on private or localhost
14+
addresses unless `-p`/`--allow-private-address` was passed, which was a
15+
regression introduced in Fedify 2.1.0 when the CLI began forwarding
16+
the `allowPrivateAddress` option to the underlying document loader.
17+
URLs explicitly provided on the command line now always allow private
18+
addresses, while URLs discovered via [`-t`/`--traverse`] or [`--recurse`]
19+
still honor the option to mitigate SSRF attacks against private
20+
addresses. [[#696], [#698] by Chanhaeng Lee]
21+
22+
[`-t`/`--traverse`]: https://fedify.dev/cli#t-traverse-traverse-the-collection
23+
[`--recurse`]: https://fedify.dev/cli#recurse-recurse-through-object-relationships
24+
[#696]: https://github.com/fedify-dev/fedify/issues/696
25+
[#698]: https://github.com/fedify-dev/fedify/pull/698
26+
1127

1228
Version 2.1.5
1329
-------------

docs/cli.md

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -522,8 +522,10 @@ and `quoteUri` are not accepted as short forms.
522522
> are mutually exclusive.
523523
>
524524
> Recursive fetches always disallow private/localhost addresses for safety.
525-
> `-p`/`--allow-private-address` only applies to explicit lookup/traverse
526-
> targets, not to recursive steps.
525+
> URLs explicitly provided on the command line always allow private
526+
> addresses, while
527+
> [`-p`/`--allow-private-address`](#p-allow-private-address-allow-private-ip-addresses)
528+
> has no effect on recursive steps.
527529
528530
### `--recurse-depth`: Set recursion depth limit
529531

@@ -980,18 +982,30 @@ fedify lookup --user-agent MyApp/1.0 @fedify@hollo.social
980982

981983
### `-p`/`--allow-private-address`: Allow private IP addresses
982984

983-
By default, `fedify lookup` does not fetch private or localhost addresses.
984-
The `-p`/`--allow-private-address` option allows explicit lookup/traverse
985-
requests to private addresses when needed for local development.
985+
URLs explicitly provided on the command line always allow private or
986+
localhost addresses, so local servers can be looked up without any extra
987+
flags:
986988

987989
~~~~ sh
988-
fedify lookup --allow-private-address http://localhost:8000/users/alice
990+
fedify lookup http://localhost:8000/users/alice
991+
~~~~
992+
993+
The `-p`/`--allow-private-address` option additionally allows private
994+
addresses for URLs discovered via traversal or recursion. It only has an
995+
effect when used together with
996+
[`-t`/`--traverse`](#t-traverse-traverse-the-collection) or
997+
[`--recurse`](#recurse-recurse-through-object-relationships), since URLs
998+
embedded in remote responses are otherwise rejected to mitigate SSRF
999+
attacks against private addresses.
1000+
1001+
~~~~ sh
1002+
fedify lookup --traverse --allow-private-address http://localhost:8000/users/alice/outbox
9891003
~~~~
9901004

9911005
> [!NOTE]
9921006
> Recursive fetches enabled by
9931007
> [`--recurse`](#recurse-recurse-through-object-relationships) continue to
994-
> disallow private addresses.
1008+
> disallow private addresses regardless of this option.
9951009
9961010
### `-s`/`--separator`: Output separator
9971011

0 commit comments

Comments
 (0)