Resolve conflicts

lib/ssrf_filter/ssrf_filter.rb

@@ -72,6 +72,7 @@ def self.prefixlen_from_ipaddr(ipaddr)
  ::Resolv.getaddresses(hostname).map { |ip| ::IPAddr.new(ip) }
  end
 
+ DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS = false
  DEFAULT_MAX_REDIRECTS = 10
 
  VERB_MAP = {
@@ -110,10 +111,13 @@ class CRLFInjection < Error
  original_url = url
  scheme_whitelist = options[:scheme_whitelist] || DEFAULT_SCHEME_WHITELIST
  resolver = options[:resolver] || DEFAULT_RESOLVER
+ allow_unfollowed_redirects = options.fetch(:allow_unfollowed_redirects) { DEFAULT_ALLOW_UNFOLLOWED_REDIRECTS }
  max_redirects = options[:max_redirects] || DEFAULT_MAX_REDIRECTS
  url = url.to_s
 
- (max_redirects + 1).times do
+ redirects = 0
+
+ loop do
  uri = URI(url)
 
  unless scheme_whitelist.include?(uri.scheme)
@@ -128,10 +132,17 @@ class CRLFInjection < Error
  raise PrivateIPAddress, "Hostname '#{hostname}' has no public ip addresses" if public_addresses.empty?
 
  response, url = fetch_once(uri, public_addresses.sample.to_s, method, options, &block)
- return response if url.nil?
- end
 
- raise TooManyRedirects, "Got #{max_redirects} redirects fetching #{original_url}"
+ break response if url.nil?
+
+ if max_redirects <= redirects
+ break response if allow_unfollowed_redirects
+
+ raise TooManyRedirects, "Got #{max_redirects} redirects fetching #{original_url}"
+ end
+
+ redirects += 1
+ end
  end
  end
 
@@ -197,7 +208,7 @@ def self.fetch_once(uri, ip, verb, options, &block)
  url = response['location']
  # Handle relative redirects
  url = "#{uri.scheme}://#{hostname}:#{uri.port}#{url}" if url.start_with?('/')
- return nil, url
+ return response, url
  else
  return response, nil
  end

spec/lib/ssrf_filter_spec.rb

@@ -460,6 +460,21 @@ def inject_custom_trust_store(*certificates)
  end.to raise_error(described_class::TooManyRedirects)
  end
 
+ it 'returns the last response if there are too many redirects and unfollowed redirects are allowed' do
+ stub_request(:get, "https://#{public_ipv4}").with(headers: {host: 'www.example.com'})
+ .to_return(status: 301, headers: {location: 'https://www.example2.com'})
+ resolver = proc { [public_ipv4] }
+ response =
+ described_class.get(
+ 'https://www.example.com',
+ resolver: resolver,
+ allow_unfollowed_redirects: true,
+ max_redirects: 0
+ )
+ expect(response.code).to eq('301')
+ expect(response['location']).to eq('https://www.example2.com')
+ end
+
  it 'fails if the redirected url is not in the scheme whitelist' do
  stub_request(:put, "https://#{public_ipv4}").with(headers: {host: 'www.example.com'})
  .to_return(status: 301, headers: {location: 'ftp://www.example.com'})