adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-08-16 04:12:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(outbound)!: per-module deny-private-ips and deny-public-ips, permissive defaults

Browse Source
This commit is contained in:
Julien Neuhart
2026-04-23 20:01:27 +02:00
parent a2a8c42457
commit 7a914fce65
13 changed files with 365 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
test/integration/features/chromium_convert_url.feature
View File

@@ -489,10 +489,21 @@ Feature: /forms/chromium/convert/url
file:// URLs are not accepted on this route. Use the /convert/html or /convert/markdown routes to render local HTML
"""
Scenario: POST /forms/chromium/convert/url (Main URL resolves to a non-public IP, allow-private-ips off)
Scenario: POST /forms/chromium/convert/url (Main URL resolves to a non-public IP, permissive default)
Given I have a Gotenberg container with the following environment variable(s):
| CHROMIUM_ALLOW_LIST | |
Given I have a static server
When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
| url | http://host.docker.internal:%d/html/testdata/page-1-html/index.html | field |
Then the response status code should be 200
Then the response header "Content-Type" should be "application/pdf"
Then there should be 1 PDF(s) in the response
Scenario: POST /forms/chromium/convert/url (Main URL resolves to a non-public IP, deny-private-ips on)
Given I have a Gotenberg container with the following environment variable(s):
| CHROMIUM_ALLOW_LIST | |
| CHROMIUM_DENY_PRIVATE_IPS | true |
Given I have a static server
When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
| url | http://host.docker.internal:%d/html/testdata/page-1-html/index.html | field |
Then the response status code should be 403
@@ -502,10 +513,10 @@ Feature: /forms/chromium/convert/url
Forbidden
"""
Scenario: POST /forms/chromium/convert/url (Main URL resolves to a non-public IP, allow-private-ips on)
Scenario: POST /forms/chromium/convert/url (Main URL resolves to a non-public IP, deny-private-ips on with allow-list bypass)
Given I have a Gotenberg container with the following environment variable(s):
| CHROMIUM_ALLOW_LIST | |
| CHROMIUM_ALLOW_PRIVATE_IPS | true |
| CHROMIUM_ALLOW_LIST | .+ |
| CHROMIUM_DENY_PRIVATE_IPS | true |
Given I have a static server
When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
| url | http://host.docker.internal:%d/html/testdata/page-1-html/index.html | field |