Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add new URL-related validation args (public, https_only, no_ip) #24

Merged
merged 10 commits into from
Nov 17, 2024
Merged

feat: add new URL-related validation args (public, https_only, no_ip) #24

merged 10 commits into from
Nov 17, 2024

Conversation

RaneemAlRushud
Copy link
Contributor

@RaneemAlRushud RaneemAlRushud commented Nov 1, 2024 •
edited
Loading

Adds 4 independent URL validation args:

  • https , public, not_private, not_ip

Screenshot 2024-11-02 at 10 16 06 PM 

# Most restrictive
rd::Url.new(['https', 'public'])

# Block private resources but allow public IPs
rd::Url.new(['not_private'])

# Block IPs but allow private domains
rd::Url.new(['not_ip'])

# Block both private resources and IPs
rd::Url.new(['not_private', 'not_ip'])

RaneemAlRushud and others added 8 commits October 27, 2024 04:45
@RaneemAlRushud
New rule: domain-only URLs (no IP addresses allowed)
4fecd86
@RaneemAlRushud
test: add not_ip_url rule test cases
5951376
@RaneemAlRushud
Merge branch 'prevent-local-url' into url-registrable-domain
552b1ba
@RaneemAlRushud
feat: add URL validation modifiers (public, https_only, no_ip)
7b36867 
Adds three independent URL validation rules:
- public: validates against real public domains
- https_only: enforces HTTPS protocol
- no_ip: blocks direct IP addresses

* `not_ip_url.rb` + `not_local_url.rb` rules have been deleted
@RaneemAlRushud
Merge branch 'ahoshaiyan:master' into url-registrable-domain
89fb951
@RaneemAlRushud
Merge remote-tracking branch 'origin/url-registrable-domain' into url…
a4130b4 
…-registrable-domain
@RaneemAlRushud
feat: add URL validation modifiers (public, https_only, no_ip)
b949767 
Adds three independent URL validation rules:
- public: validates against real public domains
- https_only: enforces HTTPS protocol
- no_ip: blocks direct IP addresses

* `not_ip_url.rb` + `not_local_url.rb` rules have been deleted
@RaneemAlRushud
Merge branch 'prevent-ip-address' of github.com:RaneemAlRushud/mini-d…
1014dab 
…efender into url-registrable-domain
ahoshaiyan
ahoshaiyan requested changes Nov 2, 2024
View reviewed changes
lib/mini_defender/rules/url.rb Outdated Show resolved Hide resolved
lib/mini_defender/rules/url.rb Outdated Show resolved Hide resolved
lib/mini_defender/rules/url.rb Outdated Show resolved Hide resolved
lib/mini_defender/rules/url.rb Outdated Show resolved Hide resolved
lib/mini_defender/data/public_domain_patterns.txt Outdated Show resolved Hide resolved
lib/mini_defender/detectors/public_domain_detector.rb Outdated Show resolved Hide resolved
lib/mini_defender/detectors/public_domain_detector.rb Outdated Show resolved Hide resolved
lib/mini_defender/detectors/public_domain_detector.rb Outdated Show resolved Hide resolved
lib/mini_defender/detectors/public_domain_detector.rb Outdated Show resolved Hide resolved
@RaneemAlRushud
refactor(url): enhance URL rule validation with domain checks + priva…
6fa45ae 
…te network check

- Use proper public domain (`public_suffix`) validation checking both structure and access

- Add pattern loading with memoization for private/reserved domains

- Fix error message consistency across validation scenarios

- Add tests for validation scenarios
@RaneemAlRushud
Restructured private patterns based on trustworthy srcs + some tests
b5dec11
@RaneemAlRushud RaneemAlRushud marked this pull request as ready for review November 4, 2024 11:35
ahoshaiyan
ahoshaiyan approved these changes Nov 17, 2024
View reviewed changes
Copy link
Owner

@ahoshaiyan ahoshaiyan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@RaneemAlRushud great work 🚀

I have some changes in mind I will do and release a new version

@ahoshaiyan ahoshaiyan merged commit adac39a into ahoshaiyan:master Nov 17, 2024
1 check passed
@RaneemAlRushud
Copy link
Contributor Author

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ahoshaiyan ahoshaiyan ahoshaiyan approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@RaneemAlRushud @ahoshaiyan