mirror of
https://github.com/soxoj/maigret.git
synced 2026-09-06 01:47:40 +02:00
AshvinandGitHub
0fd5bf66e8
* fix: block SSRF and local-file reads via report image URLs in PDF generation save_pdf_report() rendered scraped profile image URLs (ids_data['image']) straight into xhtml2pdf, which fetches <img src> while building the PDF. The image field is attacker-influenced and pisaDocument ran with no link_callback, so a profile carrying image = "file:///etc/passwd" or an intranet/metadata URL turned report generation into a local file read or an SSRF from the machine running maigret. In the web UI this is server-side and fires on every search, since save_pdf_report is always called. Add a link_callback that only lets public http(s) images through and diverts everything else (file://, data:, other schemes, and hosts that resolve to loopback/private/link-local/reserved addresses) to a bundled 1x1 placeholder, so no fetch or read happens. Diverting rather than raising keeps report generation working when a scanned profile carries a hostile image URL. Tests cover the URL classifier, the callback's placeholder diversion, and an end-to-end check that PDF generation does not fetch an internal image. * fix: use is_global to also block CGNAT (100.64.0.0/10) report image hosts The flag chain missed 100.64.0.0/10, which is neither is_private nor is_global and is routable inside many cloud and k8s networks. is_global covers it along with private, loopback, link-local and unspecified. Multicast and reserved stay explicit: both are still is_global on CPython, and 64:ff9b::/96 reaches IPv4 through a NAT64 gateway.