BSD Ports

security/ruby-ssrf_filter 1.6.0 NetBSD

Make it easy to prevent SSRF attacks

System
NetBSD
Repository
pkgsrc
Maintainer
[email protected]
Port added
Last update
Commit
e06b5f7001
License
mit
Categories
security, ruby
Package size
13.7 KiB, 28.7 KiB installed

Description

ssrf_filter makes it easy to defend against server side request forgery (SSRF) attacks. SSRF vulnerabilities happen when you accept URLs as user input and fetch them on your server (for instance, when a user enters a link into a Twitter/Facebook status update and a content preview is generated).

Users can pass in URLs or IPs such that your server will make requests to the internal network. For example if you're hosted on AWS they can request the instance metadata endpoint http://169.254.169.254/latest/meta-data/ and get your IAM credentials.

Attempts to guard against this are often implemented incorrectly, by blocking all ip addresses, not handling IPv6 or http redirects correctly, or having TOCTTOU bugs and other issues.

This gem provides a safe and easy way to fetch content from user-submitted urls. It:

* handles URIs/IPv4/IPv6, redirects, DNS, etc, correctly * has 0 runtime dependencies * has a comprehensive test suite (100% code coverage) * is tested against ruby 2.7, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 4.0, and ruby-head

Install

Binary package:

pkgin install ruby33-ssrf_filter

From pkgsrc:

cd /usr/pkgsrc/security/ruby-ssrf_filter && make install clean

Dependencies

Run dependencies 1
Required by 1

Configuration

No options to configure.

Service scripts
none
Flavors
ruby34-ssrf_filter-1.6.0, ruby40-ssrf_filter-1.6.0

Commit history 2

DateCommitCreditsLog message
e06b5f7001 taca security/ruby-ssrf_filter: update to 1.6.0
1.6.0 (2026-09-08) * Ignore proxies (arkadiyt) * Filter out some IPv6 ranges (arkadiyt) * Filter out some dummy rnages (arkadiyt) * Retry connection failures with differnet ips (arkadiyt)
e05867ea1f taca security/ruby-ssrf_filter: add version 1.5.0
This package is required by newer version of www/ruby-css-parser package. ssrf_filter makes it easy to defend against server side request forgery (SSRF) attacks. SSRF vulnerabilities happen when you accept URLs as user input and fetch them on your server (for instance, when a user enters a link into a Twitter/Facebook status update and a content preview is generated). Users can pass in URLs or IPs such that your server will make requests to the internal network. For example if you're hosted on AWS they can request the instance metadata endpoint http://169.254.169.254/latest/meta-data/ and get your IAM credentials. Attempts to guard against this are often implemented incorrectly, by blocking all ip addresses, not handling IPv6 or http redirects correctly, or …