bito-code-review[bot] commented on PR #42930:
URL: https://github.com/apache/superset/pull/42930#issuecomment-5229501072
<!-- Bito Reply -->
The flagged issue is correct. The current implementation of
`_PeerValidatingHTTPConnection` and `_PeerValidatingHTTPSConnection` only
validates the peer address after the connection is established. If an HTTP(S)
proxy is configured, `urllib` establishes the connection to the proxy server,
and `_raise_for_unsafe_peer` validates the proxy's IP address rather than the
final destination's IP address, which can lead to SSRF vulnerabilities.
To resolve this, you should explicitly disable proxy usage for these
connections by setting the `proxy` argument to `None` in the `connect` method
or by configuring the `opener` to ignore proxies for these specific requests.
Would you like me to fetch all other comments on this PR to validate them
and implement a comprehensive fix?
**superset/commands/dataset/importers/v1/utils.py**
```
class _PeerValidatingHTTPConnection(HTTPConnection):
"""HTTP connection that validates the peer address on connect."""
def connect(self) -> None:
# Explicitly disable proxy usage for this connection
self.proxy = None
super().connect()
_raise_for_unsafe_peer(self.sock)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
