Ref T6755. This improves our resistance to SSRF attacks:
- Follow redirects manually and verify each component of the redirect chain.
- Handle authentication provider profile picture fetches more strictly.
Details
Details
- Reviewers
btrahan - Maniphest Tasks
- T6755: Allow more granular configuration of `security.allow-outbound-http`
- Commits
- Restricted Diffusion Commit
rP4f8147dbb8c0: Improve protection against SSRF attacks
- Tried to download macros from various URIs which issued redirects, etc.
- Downloaded an actual macro.
- Went through external account workflow.
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Lint
Lint Not Applicable - Unit
Tests Not Applicable