fix(view): block SSRF in remote images - #1693
Open
kawacukennedy wants to merge 2 commits into
Open
Conversation
floatpanebot
added
area/tui
…lient A malicious HTML email could embed images pointing at internal services (e.g. http://169.254.169.254/latest/meta-data/ on cloud providers, or http://127.0.0.1:* to reach local applications). Every recipient who views such an email triggers a request to the attacker-controlled URL, enabling server-side request forgery. Add isPrivateHost() DNS resolution check that rejects connections to loopback (127.0.0.0/8), RFC 1918 (10/172.16-31/192.168), link-local (169.254.0.0/16), and IPv6 loopback/link-local addresses. Also limit redirect chains to 5 hops using httpclient.NewWithRedirectCap to prevent SSRF via open-redirect chains, and reuse a single HTTP client across calls instead of creating a new one per image fetch.
kawacukennedy
force-pushed
the
fix/view-html-ssrf
branch
from
July 20, 2026 01:31
f5da9c8 to
907e0a1
Compare
floatpanebot
previously requested changes
Jul 20, 2026
floatpanebot
left a comment
floatpanebot
left a comment
Member
There was a problem hiding this comment.
Hi @kawacukennedy! Please fix the following issues with your PR:
- Title: Is too long (55 characters). The PR title must be strictly under 40 characters.
- Body: Missing the
## What?or## Why?headings required by the PR template.
Member
Benchmark report — no significant changeMetrics worse: 0 · better: 0 (threshold: ±3%). benchstat outputauto-generated by benchmarks.yml |
kawacukennedy
changed the title
floatpanebot
dismissed
their stale review
July 20, 2026 01:33
Formatting issues have been resolved. Thank you!
Member
|
This has had no activity for 45 days. It will be closed in 21 days unless updated. Comment or remove the |
Contributor
Author
|
Hi @andrinoff — this PR is still open and all CI checks are green; just keeping it off the stale queue. Happy to rebase/adjust if anything needs updating. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Block remote image fetches to private/internal IP addresses and cap redirect chains to 5 hops. Reuse a single HTTP client per image fetch instead of creating one per call.
Why?
A malicious HTML email could embed images pointing at internal services (e.g. cloud metadata at
169.254.169.254, or127.0.0.1). Viewing such an email triggered an outbound request to the attacker-controlled URL, enabling SSRF.The default HTTP client also followed up to 10 redirects, allowing SSRF via redirect chains.