News for hackers. Stuff that matters.

A comment on Exploiting URL Parser in Programming Languages (2017) [pdf]. Parent comment

Re:Exploiting URL Parser in Programming Languages (2017) [pdf] by jkarneges on Monday September 10, 2018 @08:15PM (#17956196)
Some discussion about handling webhooks with evil URLs: http://blog.fanout.io/2014/01/27/how-to-safely-invoke-webhoo...
[ Parent | on HN ]
Re:Exploiting URL Parser in Programming Languages (2017) [pdf] by nicolaslem on Tuesday September 11, 2018 @08:03AM (#17958907)
The IP blacklisting section seems fragile to me. What about IPv6 or multiple A records?

I would rather let the OS connect the way it prefers and once it is connected, check that the remote is a legit IP address before sending anything.

[ Parent | on HN ]
Re:Exploiting URL Parser in Programming Languages (2017) [pdf] by jkarneges on Tuesday September 11, 2018 @11:50AM (#17960793)
IPv6: blacklist similar address ranges. Multiple A records: be sure to check against each record before connecting.

Connecting first and then checking the remote IP before sending anything could work I suppose, but I think you'd still need to check against a blacklist.

[ Parent | on HN ]