metrics,
+ UrlPolicy policy) {
var builder = HttpClients.custom()
.setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
.setDnsResolver(dns)
@@ -64,7 +81,8 @@ CloseableHttpClient ssrfHttpClient(SafeDnsResolver dns,
builder.setRedirectStrategy(new SafeRedirectStrategy(
dns,
props.getAllowedSchemes(),
- metrics.getIfAvailable(() -> NoOpSsrfGuardMetrics.INSTANCE)
+ metrics.getIfAvailable(() -> NoOpSsrfGuardMetrics.INSTANCE),
+ policy
));
} else {
builder.disableRedirectHandling();
diff --git a/ssrf-guard-jdkhttp/src/main/java/kr/devslab/ssrfguard/jdkhttp/SsrfGuardedHttpClient.java b/ssrf-guard-jdkhttp/src/main/java/kr/devslab/ssrfguard/jdkhttp/SsrfGuardedHttpClient.java
index 1263409..5b7a9d9 100644
--- a/ssrf-guard-jdkhttp/src/main/java/kr/devslab/ssrfguard/jdkhttp/SsrfGuardedHttpClient.java
+++ b/ssrf-guard-jdkhttp/src/main/java/kr/devslab/ssrfguard/jdkhttp/SsrfGuardedHttpClient.java
@@ -1,15 +1,19 @@
package kr.devslab.ssrfguard.jdkhttp;
+import kr.devslab.ssrfguard.core.BlockReason;
import kr.devslab.ssrfguard.core.NetUtil;
+import kr.devslab.ssrfguard.core.RedirectGuard;
import kr.devslab.ssrfguard.core.SsrfGuardException;
import kr.devslab.ssrfguard.core.UrlPolicy;
import java.io.IOException;
import java.net.InetAddress;
+import java.net.URI;
import java.net.UnknownHostException;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
+import java.util.Optional;
import java.util.concurrent.CompletableFuture;
/**
@@ -33,6 +37,20 @@
* HttpResponse.BodyHandlers.ofString());
* }
*
+ * Redirects
+ * The JDK client follows redirects internally when built with
+ * {@code Redirect.NORMAL} or {@code ALWAYS}, and gives no hook to inspect a
+ * hop — so before 3.2.0 a redirect off an allowlisted host was followed with
+ * NO validation at all. This wrapper therefore drives the redirect loop
+ * itself: the delegate is used with following disabled and each hop is
+ * re-validated through {@link RedirectGuard}, the same seam the other
+ * adapters use.
+ *
+ * Semantics follow the fetch specification, matching the JS sibling:
+ * {@code 303} (and {@code 301}/{@code 302} on {@code POST}) downgrade to
+ * {@code GET} and drop the body, and credential headers are stripped when a
+ * hop crosses an origin. {@code maxRedirects} bounds the chain.
+ *
*
What's NOT closed by this wrapper
* The JDK client uses {@code InetAddress.getAllByName} internally; we don't
* intercept that call. So a DNS rebinding attack could in theory
@@ -45,24 +63,58 @@
*/
public final class SsrfGuardedHttpClient {
+ /** Chain bound, matching the JS sibling's `maxRedirects` default. */
+ public static final int DEFAULT_MAX_REDIRECTS = 5;
+
private final HttpClient delegate;
private final UrlPolicy policy;
private final boolean blockPrivateNetworks;
+ private final int maxRedirects;
public SsrfGuardedHttpClient(HttpClient delegate, UrlPolicy policy) {
this(delegate, policy, true);
}
public SsrfGuardedHttpClient(HttpClient delegate, UrlPolicy policy, boolean blockPrivateNetworks) {
+ this(delegate, policy, blockPrivateNetworks, DEFAULT_MAX_REDIRECTS);
+ }
+
+ /**
+ * @param maxRedirects hops to follow before giving up. {@code 0} refuses
+ * to follow any redirect and hands the 3xx back.
+ */
+ public SsrfGuardedHttpClient(HttpClient delegate, UrlPolicy policy, boolean blockPrivateNetworks,
+ int maxRedirects) {
+ if (maxRedirects < 0) throw new IllegalArgumentException("maxRedirects must be >= 0");
+ // The guarantee this class makes is that every hop is validated. It
+ // cannot make that guarantee over a delegate that follows redirects
+ // itself: the JDK client would chase the Location header internally
+ // and this wrapper would never see the 3xx. Refusing here is loud;
+ // accepting it would be a guard that quietly does nothing on the one
+ // request shape SSRF is actually about.
+ if (delegate.followRedirects() != HttpClient.Redirect.NEVER) {
+ throw new IllegalArgumentException(
+ "SsrfGuardedHttpClient requires a delegate built with "
+ + "HttpClient.Redirect.NEVER (got " + delegate.followRedirects() + "). "
+ + "This wrapper follows and re-validates redirects itself; a delegate "
+ + "that follows them internally would bypass the policy on every hop.");
+ }
this.delegate = delegate;
this.policy = policy;
this.blockPrivateNetworks = blockPrivateNetworks;
+ this.maxRedirects = maxRedirects;
}
public HttpResponse send(HttpRequest request, HttpResponse.BodyHandler handler)
throws IOException, InterruptedException {
- guard(request);
- return delegate.send(request, handler);
+ HttpRequest current = request;
+ for (int hop = 0; ; hop++) {
+ guard(current);
+ HttpResponse response = delegate.send(current, handler);
+ HttpRequest next = nextHop(current, response, hop);
+ if (next == null) return response;
+ current = next;
+ }
}
public CompletableFuture> sendAsync(HttpRequest request, HttpResponse.BodyHandler handler) {
@@ -71,7 +123,91 @@ public CompletableFuture> sendAsync(HttpRequest request, Htt
} catch (SsrfGuardException e) {
return CompletableFuture.failedFuture(e);
}
- return delegate.sendAsync(request, handler);
+ return delegate.sendAsync(request, handler)
+ .thenCompose(response -> {
+ HttpRequest next;
+ try {
+ next = nextHop(request, response, 0);
+ } catch (SsrfGuardException e) {
+ return CompletableFuture.failedFuture(e);
+ }
+ if (next == null) return CompletableFuture.completedFuture(response);
+ return sendAsyncFrom(next, handler, 1);
+ });
+ }
+
+ private CompletableFuture> sendAsyncFrom(HttpRequest request,
+ HttpResponse.BodyHandler handler,
+ int hop) {
+ try {
+ guard(request);
+ } catch (SsrfGuardException e) {
+ return CompletableFuture.failedFuture(e);
+ }
+ return delegate.sendAsync(request, handler)
+ .thenCompose(response -> {
+ HttpRequest next;
+ try {
+ next = nextHop(request, response, hop);
+ } catch (SsrfGuardException e) {
+ return CompletableFuture.failedFuture(e);
+ }
+ if (next == null) return CompletableFuture.completedFuture(response);
+ return sendAsyncFrom(next, handler, hop + 1);
+ });
+ }
+
+ /**
+ * Build the next hop's request, or {@code null} when the response is not
+ * a redirect this client should follow. Every hop passes the full policy
+ * through {@link RedirectGuard} before it is returned, so a caller can
+ * never send a request this method produced without it having been
+ * validated.
+ */
+ private HttpRequest nextHop(HttpRequest current, HttpResponse response, int hop) {
+ int status = response.statusCode();
+ if (status < 300 || status >= 400 || status == 304) return null;
+
+ Optional location = response.headers().firstValue("location");
+ // A 3xx with no Location is not a redirect anyone can follow — hand it
+ // back rather than inventing a target.
+ if (location.isEmpty() || location.get().isBlank()) return null;
+
+ if (hop >= maxRedirects) {
+ throw new SsrfGuardException(BlockReason.BLOCKED_REDIRECT, current.uri().getScheme(),
+ current.uri().getHost(), "Too many redirects: " + maxRedirects);
+ }
+
+ URI target;
+ try {
+ target = current.uri().resolve(location.get().trim());
+ } catch (IllegalArgumentException e) {
+ throw new SsrfGuardException(BlockReason.BLOCKED_REDIRECT, current.uri().getScheme(),
+ current.uri().getHost(), "Blocked redirect: unparseable location");
+ }
+ RedirectGuard.validateHop(policy, target);
+
+ String method = current.method();
+ boolean toGet = RedirectGuard.downgradesToGet(status, method);
+ boolean crossOrigin = RedirectGuard.crossOrigin(current.uri(), target);
+
+ HttpRequest.Builder builder = HttpRequest.newBuilder(target);
+ current.timeout().ifPresent(builder::timeout);
+ current.version().ifPresent(builder::version);
+ current.headers().map().forEach((name, values) -> {
+ // Content-* headers describe a body that is not being replayed,
+ // and credentials must not cross an origin.
+ if (toGet && name.toLowerCase(java.util.Locale.ROOT).startsWith("content-")) return;
+ if (crossOrigin && RedirectGuard.isCredentialHeader(name)) return;
+ for (String value : values) builder.header(name, value);
+ });
+
+ if (toGet) {
+ builder.GET();
+ } else {
+ builder.method(method, current.bodyPublisher().orElseGet(HttpRequest.BodyPublishers::noBody));
+ }
+ return builder.build();
}
public HttpClient delegate() {
diff --git a/ssrf-guard-jdkhttp/src/test/java/kr/devslab/ssrfguard/jdkhttp/SsrfGuardedHttpClientRedirectTest.java b/ssrf-guard-jdkhttp/src/test/java/kr/devslab/ssrfguard/jdkhttp/SsrfGuardedHttpClientRedirectTest.java
new file mode 100644
index 0000000..471bc34
--- /dev/null
+++ b/ssrf-guard-jdkhttp/src/test/java/kr/devslab/ssrfguard/jdkhttp/SsrfGuardedHttpClientRedirectTest.java
@@ -0,0 +1,203 @@
+package kr.devslab.ssrfguard.jdkhttp;
+
+import com.sun.net.httpserver.HttpServer;
+import kr.devslab.ssrfguard.core.BlockReason;
+import kr.devslab.ssrfguard.core.HostPolicy;
+import kr.devslab.ssrfguard.core.NoOpSsrfGuardMetrics;
+import kr.devslab.ssrfguard.core.SsrfGuardException;
+import kr.devslab.ssrfguard.core.UrlPolicy;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * The JDK client gives no hook to inspect a redirect hop, so before 3.2.0 a
+ * redirect off an allowlisted host was followed with no validation at all.
+ * This wrapper now drives the loop itself; these tests run it against a real
+ * loopback server, because "does the guard see the hop" is a question about
+ * behaviour, not about the shape of the code.
+ */
+class SsrfGuardedHttpClientRedirectTest {
+
+ private HttpServer server;
+ private String base;
+ private final List pathsServed = new ArrayList<>();
+ private final AtomicReference lastMethod = new AtomicReference<>();
+ private final AtomicReference lastAuthHeader = new AtomicReference<>();
+
+ @BeforeEach
+ void startServer() throws IOException {
+ server = HttpServer.create(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 0);
+ server.createContext("/", exchange -> {
+ String path = exchange.getRequestURI().getPath();
+ pathsServed.add(path);
+ lastMethod.set(exchange.getRequestMethod());
+ lastAuthHeader.set(exchange.getRequestHeaders().getFirst("Authorization"));
+
+ String location = switch (path) {
+ case "/to-metadata" -> "http://169.254.169.254/latest/meta-data/";
+ case "/to-other-port" -> base.replace(portOf(base), "9") + "/end";
+ case "/to-self" -> "/to-self";
+ case "/hop" -> "/end";
+ default -> null;
+ };
+
+ if (location != null) {
+ exchange.getResponseHeaders().add("Location", location);
+ exchange.sendResponseHeaders(302, -1);
+ } else if (path.equals("/see-other")) {
+ exchange.getResponseHeaders().add("Location", "/end");
+ exchange.sendResponseHeaders(303, -1);
+ } else {
+ byte[] body = "done".getBytes(StandardCharsets.UTF_8);
+ exchange.sendResponseHeaders(200, body.length);
+ exchange.getResponseBody().write(body);
+ }
+ exchange.close();
+ });
+ server.start();
+ base = "http://" + InetAddress.getLoopbackAddress().getHostAddress() + ":" + server.getAddress().getPort();
+ }
+
+ @AfterEach
+ void stopServer() {
+ server.stop(0);
+ }
+
+ private static String portOf(String url) {
+ return url.substring(url.lastIndexOf(':') + 1);
+ }
+
+ /** Loopback is the target, so the private-IP rule has to be off to test redirects at all. */
+ private UrlPolicy loopbackPolicy() {
+ String host = InetAddress.getLoopbackAddress().getHostAddress();
+ return new UrlPolicy(
+ Set.of("http", "https"),
+ Set.of(-1, 80, 443, server.getAddress().getPort()),
+ new HostPolicy(List.of(host), List.of()),
+ false, // the target IS an IP literal here
+ true,
+ NoOpSsrfGuardMetrics.INSTANCE
+ );
+ }
+
+ private SsrfGuardedHttpClient client(UrlPolicy policy) {
+ return new SsrfGuardedHttpClient(
+ HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build(),
+ policy, false);
+ }
+
+ @Test
+ void refuses_a_delegate_that_follows_redirects_itself() {
+ // Accepting one would mean the JDK chases Location internally and this
+ // wrapper never sees a hop — a guard that silently does nothing.
+ assertThatIllegalArgumentException().isThrownBy(() -> new SsrfGuardedHttpClient(
+ HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NORMAL).build(),
+ loopbackPolicy(), false))
+ .withMessageContaining("Redirect.NEVER");
+ }
+
+ @Test
+ void follows_an_allowed_redirect_and_returns_the_final_response() throws Exception {
+ var response = client(loopbackPolicy()).send(
+ HttpRequest.newBuilder(URI.create(base + "/hop")).build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ assertThat(response.statusCode()).isEqualTo(200);
+ assertThat(response.body()).isEqualTo("done");
+ assertThat(pathsServed).containsExactly("/hop", "/end");
+ }
+
+ @Test
+ void blocks_a_redirect_to_cloud_metadata() {
+ // The hop the whole library exists for: an allowlisted host answering
+ // with a Location that points at the metadata service.
+ assertThatExceptionOfType(SsrfGuardException.class)
+ .isThrownBy(() -> client(loopbackPolicy()).send(
+ HttpRequest.newBuilder(URI.create(base + "/to-metadata")).build(),
+ HttpResponse.BodyHandlers.ofString()))
+ .matches(e -> e.reason() == BlockReason.BLOCKED_REDIRECT);
+
+ assertThat(pathsServed).containsExactly("/to-metadata");
+ }
+
+ @Test
+ void blocks_a_redirect_to_a_port_outside_the_policy() {
+ // Not caught before 3.2.0: the old hop check looked at the scheme and
+ // the host, so a port change on an allowlisted host was followed.
+ assertThatExceptionOfType(SsrfGuardException.class)
+ .isThrownBy(() -> client(loopbackPolicy()).send(
+ HttpRequest.newBuilder(URI.create(base + "/to-other-port")).build(),
+ HttpResponse.BodyHandlers.ofString()))
+ .matches(e -> e.reason() == BlockReason.BLOCKED_REDIRECT);
+ }
+
+ @Test
+ void gives_up_after_max_redirects() {
+ var client = new SsrfGuardedHttpClient(
+ HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build(),
+ loopbackPolicy(), false, 2);
+
+ assertThatExceptionOfType(SsrfGuardException.class)
+ .isThrownBy(() -> client.send(
+ HttpRequest.newBuilder(URI.create(base + "/to-self")).build(),
+ HttpResponse.BodyHandlers.ofString()))
+ .matches(e -> e.reason() == BlockReason.BLOCKED_REDIRECT)
+ .withMessageContaining("Too many redirects");
+ }
+
+ @Test
+ void downgrades_a_303_to_get_and_drops_the_body() throws Exception {
+ var response = client(loopbackPolicy()).send(
+ HttpRequest.newBuilder(URI.create(base + "/see-other"))
+ .POST(HttpRequest.BodyPublishers.ofString("payload"))
+ .build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ assertThat(response.statusCode()).isEqualTo(200);
+ assertThat(lastMethod.get()).isEqualTo("GET");
+ }
+
+ @Test
+ void keeps_credentials_on_a_same_origin_hop() throws Exception {
+ client(loopbackPolicy()).send(
+ HttpRequest.newBuilder(URI.create(base + "/hop"))
+ .header("Authorization", "Bearer sekrit")
+ .build(),
+ HttpResponse.BodyHandlers.ofString());
+
+ // Same scheme, host and port — nothing to protect against here, and
+ // stripping would break ordinary authenticated redirects.
+ assertThat(lastAuthHeader.get()).isEqualTo("Bearer sekrit");
+ }
+
+ @Test
+ void maxRedirects_zero_hands_the_3xx_back_untouched() {
+ var client = new SsrfGuardedHttpClient(
+ HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build(),
+ loopbackPolicy(), false, 0);
+
+ assertThatExceptionOfType(SsrfGuardException.class)
+ .isThrownBy(() -> client.send(
+ HttpRequest.newBuilder(URI.create(base + "/hop")).build(),
+ HttpResponse.BodyHandlers.ofString()))
+ .withMessageContaining("Too many redirects");
+ }
+}