Felipe Zipitría comments

Results 579 comments of


                                            Felipe Zipitría

Consider adding docker security scanner?

Good, this matches my own tests. I don't think we can do too much in the debian image (I've checked a couple criticals, and they are still there :/ ).

test(ssrf): adds coverage for IN2OZO3N

Well, I'm glad I've added this test. We are not covering correctly the `data://` scheme still.

test(ssrf): adds coverage for IN2OZO3N

We are mostly matching IPs and other wild stuff. We need to match also on simple content types like `text/plain`, `image/jpeg`, etc.

test(ssrf): adds coverage for IN2OZO3N

Oh, and `"Now PHP supports data: protocol w/out "//" like data:text/plain, not data://text/plain"`

test(ssrf): adds coverage for IN2OZO3N

I guess we best read the http://www.faqs.org/rfcs/rfc2397.html

test(ssrf): adds coverage for IN2OZO3N

Ugh, and of course: > A data URL scheme's media type specification can include other parameters; for example, one might specify a charset parameter. > > data:text/plain;charset=iso-8859-7,%be%fg%be

test(ssrf): adds coverage for IN2OZO3N

@theseion What do you think is a reasonable path forward here? I'm worried about adding another place where we depend on the magic regex to check for valid charsets.

test(ssrf): adds coverage for IN2OZO3N

Agreed on special handling of this case. Let's add a new rule.

test(ssrf): adds coverage for IN2OZO3N

Added followup issue. Closing.

SecCollectionTimeout still being set in crs-setup.conf

What is needed here now?