mealie

mirror of https://github.com/mealie-recipes/mealie.git synced 2026-07-25 09:00:37 -04:00

Files

Hayden ce88ed6841 fix: harden server-initiated HTTP against SSRF and DNS rebinding

Route all server-initiated outbound HTTP through one SSRF-protected layer:

- Resolve each host once, validate every resolved address (private,
  loopback, link-local, CGNAT 100.64/10, multicast, reserved, unspecified,
  IPv4-mapped IPv6), and reject if any is unsafe.
- Pin the connection to the validated address via curl's RESOLVE option so
  curl cannot re-resolve to a rebound IP (closes the validate-then-connect
  TOCTOU). Uses getaddrinfo so IPv6 records are checked too.
- Add a sync SafeTransport and safehttp.post, and move the webhook and
  recipe-action paths off raw requests.post so they are guarded like the
  scraper.
- Add HTTP_ALLOW_LIST / HTTP_DISALLOW_LIST settings (deny > allow > default)
  so operators can reach an internal server or block extra hosts.

Apprise notifications egress through the third-party library and are not
covered here.

2026-07-19 21:41:30 -05:00

test_group_cookbooks.py

feat: Simplify Default Layout Logic and Add Household.name To Cookbooks API (#6243 )

2025-09-25 18:01:10 -05:00

test_group_invitation.py

fix: disable invitations when password login is disabled (#6781 )

2026-01-30 20:05:40 +00:00

test_group_mealplan_rules.py

feat: Query Filter Builder for Cookbooks and Meal Plans (#4346 )

2024-10-17 17:35:39 +02:00

test_group_mealplan.py

chore(deps): update dependency ruff to ^0.9.0 (#4871 )