From 8350bef3e3baea6042ed3780a054cc65707e9f8d Mon Sep 17 00:00:00 2001
From: Dennis Fink
Date: Mon, 10 Aug 2026 19:36:49 +0200
Subject: fix(receiver): prevent requests to non-public addresses

Resolve source hostnames before fetching and reject addresses that are
not globally routable to prevent SSRF against local or private services.

Repeat the check for every HTTP request so redirects cannot bypass the
initial source validation. Treat DNS resolution failures during
verification as temporary fetch errors.
---
 tests/test_views.py | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'tests/test_views.py')

diff --git a/tests/test_views.py b/tests/test_views.py
index d7fd798..70ed732 100644
--- a/tests/test_views.py
+++ b/tests/test_views.py
@@ -42,6 +42,7 @@ def test_endpoint_creates_webmention(
     client: FlaskClient,
     views_module: ModuleType,
     monkeypatch: pytest.MonkeyPatch,
+    public_dns: None,
 ) -> None:
     queued: list[uuid.UUID] = []
 
@@ -85,6 +86,7 @@ def test_endpoint_is_idempotent(
     client: FlaskClient,
     views_module: ModuleType,
     monkeypatch: pytest.MonkeyPatch,
+    public_dns: None,
 ) -> None:
     queued: list[uuid.UUID] = []
 
@@ -138,6 +140,7 @@ def test_resending_resets_failure_state(
     client: FlaskClient,
     views_module: ModuleType,
     monkeypatch: pytest.MonkeyPatch,
+    public_dns: None,
 ) -> None:
     monkeypatch.setattr(
         views_module,
-- 
cgit v1.3.1