Struct SsrfSafeResolver 

pub struct SsrfSafeResolver { /* private fields */ }

A ureq::unversioned::resolver::Resolver that pins DNS resolution to the exact lookup used for the SSRF check.

SafeUrl::ensure_resolves_safely and ureq’s own resolver each perform an independent DNS lookup, which opens a rebinding window: a hostile resolver with a short TTL can answer the first (validation) query with a public address and the second (connect) query with a blocked one (e.g. the cloud metadata IP or loopback). Passing this resolver to the ureq::Agent makes resolution and validation the same lookup, so there is no second query left to rebind.

Trait Implementations

impl Debug for SsrfSafeResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SsrfSafeResolver

fn default() -> SsrfSafeResolver

Returns the “default value” for a type.

impl Resolver for SsrfSafeResolver

fn resolve( &self, uri: &Uri, config: &Config, timeout: NextTimeout, ) -> Result<ResolvedSocketAddrs, Error>

Resolve the URI to a socket address.

fn empty( &self, ) -> ArrayVec<SocketAddr, ureq::::unversioned::resolver::ResolvedSocketAddrs::{constant#0}>

Produce an empty array of addresses.