fix(receiver): prevent requests to non-public addresses

Resolve source hostnames before fetching and reject addresses that are
not globally routable to prevent SSRF against local or private services.

Repeat the check for every HTTP request so redirects cannot bypass the
initial source validation. Treat DNS resolution failures during
verification as temporary fetch errors.

1 files changed, 25 insertions, 0 deletions

diff --git a/webmentions_ssg/forms/validators.py b/webmentions_ssg/forms/validators.py
index 20d9ebf..e979644 100644
--- a/webmentions_ssg/forms/validators.py
+++ b/webmentions_ssg/forms/validators.py
@@ -3,6 +3,12 @@ from urllib.parse import urlsplit
 from flask import current_app
 from wtforms import ValidationError
 
+from ..url_security import (
+    AddressResolutionError,
+    NonPublicAddressError,
+    ensure_public_url,
+)
+
 
 class NotEqualTo:
     """
@@ -60,3 +66,22 @@ class AllowedHostname:
             message = field.gettext("Invalid input.")
 
         raise ValidationError(message)
+
+
+class PublicURL:
+    def __init__(self, message=None):
+        self.message = message
+
+    def __call__(self, form, field):
+        try:
+            ensure_public_url(field.data)
+        except (
+            AddressResolutionError,
+            NonPublicAddressError,
+        ) as exc:
+            message = self.message
+
+            if message is None:
+                message = field.gettext("URL must resolve to a public address.")
+
+            raise ValidationError(message) from exc