Faraday::RestrictIPAddresses
Prevent Faraday from hitting an arbitrary list of IP addresses, with helpers for RFC 1918 networks, RFC 6890 networks, and localhost.
System DNS facilities are used, so lookups should be cached instead of making another request. Addresses are invalid if a host has has at least one invalid DNS entry.
Usage
faraday = Faraday.new do |builder|
builder.request :url_encoded
builder.request :restrict_ip_addresses, deny_rfc6890: true,
allow_localhost: true,
deny: ['8.0.0.0/8',
'224.0.0.0/7'],
allow: ['192.168.0.0/24']
builder.adapter Faraday.default_adapter
end
faraday.get 'http://www.badgerbadgerbadger.com' # 150.0.0.150 or something
# => cool
faraday.get 'http://malicious-callback.com' # 172.0.0.150, maybe a secret internal server? Maybe not?
# => raises Faraday::RestrictIPAddresses::AddressNotAllowedPermit/denied order is:
- All addresses are allowed, except
- Addresses that are denied, except
- Addresses that are allowed.
Author
Dat @bhuga with shoutouts to @mastahyeti's gist.
UNLICENSE
It's right there.