Ref T6755. This improves our resistance to SSRF attacks:
- Follow redirects manually and verify each component of the redirect chain.
- Handle authentication provider profile picture fetches more strictly.
Details
Details
- Reviewers
btrahan - Maniphest Tasks
- T6755: Allow more granular configuration of `security.allow-outbound-http`
- Commits
- Restricted Diffusion Commit
rP4f8147dbb8c0: Improve protection against SSRF attacks
- Tried to download macros from various URIs which issued redirects, etc.
- Downloaded an actual macro.
- Went through external account workflow.
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Branch
- redirectmore
- Lint
Lint Passed - Unit
Tests Passed - Build Status
Buildable 4968 Build 4986: [Placeholder Plan] Wait for 30 Seconds