Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

 1case MatchBuiltinExternal:
 2    if ip.IsGlobalUnicast() && !ip.IsPrivate() {
 3        return true
 4    }

 1go test -v ./modules/hostmatcher -run TestSSRFBypassRanges

 1--- FAIL: TestSSRFBypassRanges/CGNAT_100.64.0.0/10_(RFC_6598)
 2    Error: Not equal: expected: false, actual: true
 3    Messages: ip=100.64.0.1
 4--- FAIL: TestSSRFBypassRanges/Azure_WireServer_168.63.129.16
 5    Error: Not equal: expected: false, actual: true
 6    Messages: ip=168.63.129.16
 7--- FAIL: TestSSRFBypassRanges/IPv6_NAT64_embedded_AWS_IMDS_169.254.169.254
 8    Error: Not equal: expected: false, actual: true
 9    Messages: ip=64:ff9b::a9fe:a9fe

 1diff --git a/modules/hostmatcher/hostmatcher_test.go b/modules/hostmatcher/hostmatcher_test.go
 2index c781847..0b39e60 100644
 3--- a/modules/hostmatcher/hostmatcher_test.go
 4+++ b/modules/hostmatcher/hostmatcher_test.go
 5@@ -159,3 +159,56 @@ func TestHostOrIPMatchesList(t *testing.T) {
 6 	}
 7 	test(cases)
 8 }
 9+
10+// TestSSRFBypassRanges verifies that the "external" filter (the default used by
11+// webhook delivery and repository migrations) blocks dangerous IP ranges.
12+//
13+// Each subtest's `allowed` field is the expected return value of MatchHostOrIP:
14+//   - false: the IP should be blocked (rejected by the filter)
15+//   - true:  the IP should be allowed (a legitimate public destination)
16+//
17+// Subtests that FAIL are documented SSRF bypasses: IP ranges that should be
18+// blocked but are incorrectly allowed because the underlying check relies on
19+// net.IP.IsPrivate(), which only covers RFC 1918 and RFC 4193.
20+func TestSSRFBypassRanges(t *testing.T) {
21+	type tc struct {
22+		ip      net.IP
23+		allowed bool
24+	}
25+
26+	hl := ParseHostMatchList("", "external")
27+
28+	cases := map[string]tc{
29+		// RFC 1918 / IPv6 private ranges - correctly blocked
30+		"RFC1918 10.0.0.0/8":        {net.ParseIP("10.0.0.1"), false},
31+		"RFC1918 172.16.0.0/12":     {net.ParseIP("172.16.0.1"), false},
32+		"RFC1918 192.168.0.0/16":    {net.ParseIP("192.168.1.1"), false},
33+		"IPv6 loopback ::1":         {net.ParseIP("::1"), false},
34+		"IPv6 link-local fe80::/10": {net.ParseIP("fe80::1"), false},
35+		"IPv6 ULA fd00::/8":         {net.ParseIP("fd00::1"), false},
36+
37+		// Legitimate public IPs - correctly allowed
38+		"Public IPv4 (Google DNS)": {net.ParseIP("8.8.8.8"), true},
39+		"Public IPv6 (Google DNS)": {net.ParseIP("2001:4860:4860::8888"), true},
40+
41+		// SSRF bypasses - the assertions below intentionally describe the
42+		// expected secure behavior (allowed=false). Each failing subtest is
43+		// a documented bypass.
44+		"CGNAT 100.64.0.0/10 (RFC 6598)":              {net.ParseIP("100.64.0.1"), false},
45+		"CGNAT 100.127.255.254 (RFC 6598)":            {net.ParseIP("100.127.255.254"), false},
46+		"Azure WireServer 168.63.129.16":              {net.ParseIP("168.63.129.16"), false},
47+		"Non-RFC1918 172.32.0.0/11":                   {net.ParseIP("172.32.0.1"), false},
48+		"Non-RFC1918 172.45.0.0/16":                   {net.ParseIP("172.45.0.1"), false},
49+		"IPv6 NAT64 64:ff9b::/96 (RFC 6052)":          {net.ParseIP("64:ff9b::1"), false},
50+		"IPv6 NAT64 embedded AWS IMDS 169.254.169.254": {net.ParseIP("64:ff9b::a9fe:a9fe"), false},
51+		"IPv6 Teredo 2001::/32 (RFC 4380)":            {net.ParseIP("2001::1"), false},
52+		"IPv6 6to4 2002::/16 (RFC 3056)":              {net.ParseIP("2002::1"), false},
53+		"IPv6 documentation 2001:db8::/32 (RFC 3849)": {net.ParseIP("2001:db8::1"), false},
54+	}
55+
56+	for name, c := range cases {
57+		t.Run(name, func(t *testing.T) {
58+			assert.Equalf(t, c.allowed, hl.MatchHostOrIP("", c.ip), "ip=%v", c.ip)
59+		})
60+	}
61+}