|
1 | | -use std::{io::Cursor, net::IpAddr, sync::Arc, time::Duration}; |
| 1 | +use std::{io::Cursor, sync::Arc, time::Duration}; |
2 | 2 |
|
3 | 3 | use image::io::Reader as ImgReader; |
4 | 4 | use ipaddress::IPAddress; |
@@ -690,60 +690,6 @@ async fn download_html(client: &reqwest::Client, url: &str) -> Result<UrlPreview |
690 | 690 | Ok(data) |
691 | 691 | } |
692 | 692 |
|
693 | | -// TOOD: re-evaluate if this is needed, because it doesn't seem to work |
694 | | -pub(crate) fn url_request_allowed(addr: &IpAddr) -> bool { |
695 | | - // TODO: make this check ip_range_denylist |
696 | | - |
697 | | - // could be implemented with reqwest when it supports IP filtering: |
698 | | - // https://github.com/seanmonstar/reqwest/issues/1515 |
699 | | - |
700 | | - // These checks have been taken from the Rust core/net/ipaddr.rs crate, |
701 | | - // IpAddr::V4.is_global() and IpAddr::V6.is_global(), as .is_global is not |
702 | | - // yet stabilized. TODO: Once this is stable, this match can be simplified. |
703 | | - match addr { |
704 | | - IpAddr::V4(ip4) => { |
705 | | - !(ip4.octets()[0] == 0 // "This network" |
706 | | - || ip4.is_private() |
707 | | - || (ip4.octets()[0] == 100 && (ip4.octets()[1] & 0b1100_0000 == 0b0100_0000)) // is_shared() |
708 | | - || ip4.is_loopback() |
709 | | - || ip4.is_link_local() |
710 | | - // addresses reserved for future protocols (`192.0.0.0/24`) |
711 | | - || (ip4.octets()[0] == 192 && ip4.octets()[1] == 0 && ip4.octets()[2] == 0) |
712 | | - || ip4.is_documentation() |
713 | | - || (ip4.octets()[0] == 198 && (ip4.octets()[1] & 0xfe) == 18) // is_benchmarking() |
714 | | - || (ip4.octets()[0] & 240 == 240 && !ip4.is_broadcast()) // is_reserved() |
715 | | - || ip4.is_broadcast()) |
716 | | - }, |
717 | | - IpAddr::V6(ip6) => { |
718 | | - !(ip6.is_unspecified() |
719 | | - || ip6.is_loopback() |
720 | | - // IPv4-mapped Address (`::ffff:0:0/96`) |
721 | | - || matches!(ip6.segments(), [0, 0, 0, 0, 0, 0xffff, _, _]) |
722 | | - // IPv4-IPv6 Translat. (`64:ff9b:1::/48`) |
723 | | - || matches!(ip6.segments(), [0x64, 0xff9b, 1, _, _, _, _, _]) |
724 | | - // Discard-Only Address Block (`100::/64`) |
725 | | - || matches!(ip6.segments(), [0x100, 0, 0, 0, _, _, _, _]) |
726 | | - // IETF Protocol Assignments (`2001::/23`) |
727 | | - || (matches!(ip6.segments(), [0x2001, b, _, _, _, _, _, _] if b < 0x200) |
728 | | - && !( |
729 | | - // Port Control Protocol Anycast (`2001:1::1`) |
730 | | - u128::from_be_bytes(ip6.octets()) == 0x2001_0001_0000_0000_0000_0000_0000_0001 |
731 | | - // Traversal Using Relays around NAT Anycast (`2001:1::2`) |
732 | | - || u128::from_be_bytes(ip6.octets()) == 0x2001_0001_0000_0000_0000_0000_0000_0002 |
733 | | - // AMT (`2001:3::/32`) |
734 | | - || matches!(ip6.segments(), [0x2001, 3, _, _, _, _, _, _]) |
735 | | - // AS112-v6 (`2001:4:112::/48`) |
736 | | - || matches!(ip6.segments(), [0x2001, 4, 0x112, _, _, _, _, _]) |
737 | | - // ORCHIDv2 (`2001:20::/28`) |
738 | | - || matches!(ip6.segments(), [0x2001, b, _, _, _, _, _, _] if (0x20..=0x2F).contains(&b)) |
739 | | - )) |
740 | | - || ((ip6.segments()[0] == 0x2001) && (ip6.segments()[1] == 0xdb8)) // is_documentation() |
741 | | - || ((ip6.segments()[0] & 0xfe00) == 0xfc00) // is_unique_local() |
742 | | - || ((ip6.segments()[0] & 0xffc0) == 0xfe80)) // is_unicast_link_local |
743 | | - }, |
744 | | - } |
745 | | -} |
746 | | - |
747 | 693 | async fn request_url_preview(url: &str) -> Result<UrlPreviewData> { |
748 | 694 | if let Ok(ip) = IPAddress::parse(url) { |
749 | 695 | let cidr_ranges_s = services().globals.ip_range_denylist().to_vec(); |
@@ -786,16 +732,6 @@ async fn request_url_preview(url: &str) -> Result<UrlPreviewData> { |
786 | 732 | } |
787 | 733 | } |
788 | 734 |
|
789 | | - if !response |
790 | | - .remote_addr() |
791 | | - .map_or(false, |a| url_request_allowed(&a.ip())) |
792 | | - { |
793 | | - return Err(Error::BadRequest( |
794 | | - ErrorKind::forbidden(), |
795 | | - "Requesting from this address is forbidden", |
796 | | - )); |
797 | | - } |
798 | | - |
799 | 735 | let Some(content_type) = response |
800 | 736 | .headers() |
801 | 737 | .get(reqwest::header::CONTENT_TYPE) |
|
0 commit comments