3 ms·
One thing to be cognizant of: if you're planning to run this sort of thing against potentially untrusted URLs, the browser might be able to make requests to int
by jchw 2y ago
One thing to be cognizant of: if you're planning to run this sort of thing against potentially untrusted URLs, the browser might be able to make requests to internal hosts in whatever network it is on. It would be wise, on Linux, to use network namespaces, and block any local IP range in the namespace, or use a network namespace to limit the browser to a wireguard VPN tunnel to some other network.
- remram 2y agoVery important note! This is called Server-Side Request Forgery (SSRF).
- jot 2y agoToo many developers learn this the hard way. It’s one of the top reasons larger organisations prefer to use hosted services rather than doing it themselves.
- leptons 2y agoThis is true for practically every web browser anyone uses on any site that they don't personally control.
- jchw 2y agoThis is true, although I think in a home environment, there aren't as many interesting things to hit, and you're limited by Same Origin Policy, as well as certain mitigations that web browsers deploy against attacks like DNS Rebinding. However, if you're running this on a server, there's a much greater likelihood that interesting services are under the firewall, e.g. maybe the Kubernetes API server. Code execution could potentially be a form post away.
- anonzzzies 2y agoIs there a self hosted version that does this properly?