private_address_check
private_address_check copied to clipboard
Raise PrivateAddressCheck::PrivateConnectionAttemptedError even when host is missing
In fixing the TOC TOU issue the behavior changed in checking addresses. It now will only fail when the server exists. This seems less ideal because assuming the errors are show back to the user, it can reveal what server/ports are locally. For example, a user could enumerate the localhost ports and based on what is "Not Found" vs "Not allowed to use a private address" would leak information about the system.
I feel like this should be handled by the gem, but if not, I can catch this locally around the private_address_check
's and cover my use case.
@jtdowney thoughts on this?
This would be really great to get merged in!