SSRF Operator Configuration#434
Conversation
Artifact Size Comparison 📦
|
Benchmarks clangBenchmark execution time: 2025-07-30 19:12:18 Comparing candidate commit 2f60fc1 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 1 metrics, 0 unstable metrics. |
Benchmarks gccBenchmark execution time: 2025-07-30 19:12:51 Comparing candidate commit 2f60fc1 in PR branch Found 1 performance improvements and 0 performance regressions! Performance is the same for 0 metrics, 0 unstable metrics. scenario:global-benchmark.random.gcc
|
Benchmarks clang-pgoBenchmark execution time: 2025-07-29 09:38:06 Comparing candidate commit 6a7d4b4 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 1 metrics, 0 unstable metrics. |
6aa0f27 to
1605009
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #434 +/- ##
==========================================
- Coverage 85.32% 85.30% -0.02%
==========================================
Files 175 176 +1
Lines 8953 9031 +78
Branches 3926 3968 +42
==========================================
+ Hits 7639 7704 +65
- Misses 506 512 +6
- Partials 808 815 +7
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1605009 to
0f9db1b
Compare
e25f7f9 to
0748db7
Compare
0748db7 to
c5289a3
Compare
86a6c4e to
758fe7f
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR implements SSRF (Server-Side Request Forgery) configuration capabilities as defined in RFC-1049, allowing security teams to customize SSRF detection heuristics through configurable options and policies. The implementation provides granular control over authority, path, and query inspection, along with customizable allowed schemes, forbidden domains, and forbidden IP ranges.
Key changes:
- Updated SSRF detector operator to version 3 with configurable options and policies
- Added comprehensive test coverage for all configuration scenarios
- Introduced flexible enforcement modes including policy-only enforcement and full URL injection detection
Reviewed Changes
Copilot reviewed 25 out of 25 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
validator/tests/rules/structured/ssrf-config/ruleset.yaml |
Defines five SSRF detection rules with different configuration options for testing |
validator/tests/rules/structured/ssrf-config/*.yaml |
Test cases covering various SSRF detection scenarios with different configurations |
tests/unit/condition/ssrf_detector_test.cpp |
Unit tests for SSRF detector with configurable options and policies |
src/configuration/common/expression_parser.cpp |
Template specialization for parsing SSRF detector configuration from YAML |
src/condition/ssrf_detector.hpp |
Header updates adding configuration options, policies, and version bump |
src/condition/ssrf_detector.cpp |
Core implementation of configurable SSRF detection logic |
Comments suppressed due to low confidence (2)
src/condition/ssrf_detector.hpp:37
- The variable name
default_forbidden_ipssuggests it contains IP addresses, but it actually contains IP ranges in CIDR notation. Consider renaming todefault_forbidden_ip_rangesordefault_forbidden_cidrsfor clarity.
static constexpr std::array<std::string_view, 10> default_forbidden_ips{"169.254.0.0/16",
src/condition/ssrf_detector.cpp:173
- The variable name
forbidden_domainis misleading as it can hold any of the forbidden domains, not a specific one. Consider renaming tomatched_forbidden_domainto clarify its purpose.
std::string_view forbidden_domain = {};
758fe7f to
ea5e46b
Compare
This PR introduces SSRF configuration as defined in RFC-1049, allowing the security team to better tweak the SSRF heuristic.
The default configuration of the SSRF rule can be seen below:
The version of the operator has also been increased to v3.
Related Jiras: APPSEC-58463