Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 30
fleet/changes
History
Konstantin Sykulev 3d4a3e1b87
Added deny list for checking external user submitted urls (#39947) 
This PR changes 3 things.
1. Validate `admin_url` + all URLs for HTTPS/non-private
2. Add custom `DialContext` hook in fleethttp.NewClient(), this is
needed for DNS-rebinding protection at connection time
3. Validate Smallstep SCEP challenge endpoint 

# **IMPORTANT**
There are two validations occurring.
1. `CheckURLForSSRF`
2. `SSRFDialContext`

## Why?
`CheckURLForSSRF` checks the hostname. It resolves DNS, validates the
ip, and then returns an error to the user. It protects certificate
authority create/update API endpoints. But then
`GetSmallstepSCEPChallenge` calls `http.NewRequest(http.MethodPost,
ca.ChallengeURL, ...)` with the original hostname
This is where `SSRFDialContext` comes into play. It fires when an actual
HTTP request is attempted. Meaning Fleet would first build the request,
encode the body, set up TLS, etc., before being blocked at the dial.
`CheckURLForSSRF` stops the operation before any of that work happens.
`SSRFDialContext` protects the actual challenge fetch that happens later
at enrollment time. They're not always called together. The dial-time
check is the only thing protecting the enrollment request and DNS
rebinding.

## Should we remove `CheckURLForSSRF`
This is debatable and I don't have a strong opinion. Removing
`CheckURLForSSRF` would still provide the same protection. However, it
would return a generic connection error from the HTTP client which would
make it slightly hard to diagnose why it is broken.

## What's next
I implemented this for certificate authorities. I am sure there are
other places in the code base that take user submitted urls and could
also use this check. That is outside the scope of this particular PR.
But worthy to investigate in the near future.

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.


## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Security**
* Added SSRF protections for validating external URLs and blocking
private/IP-metadata ranges; dev mode can bypass checks for local testing
* **New Features**
* Introduced an SSRF-protected HTTP transport and an option to supply a
custom transport per client
* **Tests**
* Added comprehensive tests covering SSRF validation, dialing behavior,
and resolution edge cases
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-02-17 17:09:52 -06:00
..
victor Fixed issue where different variations of the same software weren't linked to the same software title. (#38926) 2026-01-30 23:04:10 +01:00
.keep Issue 1009 calculate diff software (#1305) 2021-07-08 13:57:43 -03:00
13800-obfuscate-calendar-key Obfuscate calendar key (#38687) 2026-01-26 16:59:13 -07:00
13836-cert-batch-del Optimizing certificate template batch delete auth (#38650) 2026-01-24 17:47:17 -06:00
14087-authenticate-carve-block-endpoint-before-parsing-data Authenticate carve block endpoint before parsing the "data" field (#39353) 2026-02-05 15:55:03 -03:00
14115-fix-panic-in-grpc-launcher Fix panic in gRPC launcher API handler (#39409) 2026-02-06 09:31:14 -03:00
14236-bootstrap-puppet Fix bootstrap assignment in preassign endpoint (#39619) 2026-02-10 16:55:00 -05:00
14284-external-deny-list Added deny list for checking external user submitted urls (#39947) 2026-02-17 17:09:52 -06:00
17972-move-entra-instructions #17972 Move Windows automatic enrollment configuration instructions out of Fleet UI (#38949) 2026-01-30 10:05:07 -06:00
25080-show-manage-automations-queries-policies-pages Show Manage Automations disabled button with tooltip on Policies page (#39392) 2026-02-09 15:41:31 -03:00
26405-jetbrains Jetbrains override query (#39800) 2026-02-17 08:00:36 -07:00
27432-add-ipod-support Add support for iPods under iOS devices (#27432) 2026-01-29 13:54:37 -05:00
29076-vuln-freetier-webhook Allow vulnerability webhook to fire for fleet free (#39810) 2026-02-16 11:02:48 -06:00
30392-surface-failed-install-details Populate LastInstall for failed installs (#38655) 2026-01-23 18:07:28 -05:00
30670-python-cve Updated Python cve product (#39756) 2026-02-12 12:11:01 -06:00
30691-remove-vpp-install-data-host-delete Remove host's VPP install rows when removing host (#38344) 2026-01-22 13:04:11 -05:00
30967-disable-calendar-manage-policy-automations-no-team Disable Calendar option in Policy > Manage automations for No team (#39784) 2026-02-12 15:15:02 -08:00
31160-fix-setting-automation Fleet UI: Fix software/script policy update logic (#38664) 2026-01-28 22:10:25 -05:00
31663-installed-sw-failure Fleet UI: installed sw in inventory do not show failures (#38458) 2026-02-02 12:19:55 -05:00
31922-do-not-send-windows-profiles-atomically Allow <Atomic> windows profiles (#38272) 2026-01-14 14:44:47 -05:00
32619-gitops make generate-gitops export FMAs correctly (#38420) 2026-01-20 16:31:41 -05:00
32965-hash-package-name-filters Add hash_sha256 and package_name filters (#38474) 2026-01-20 09:50:56 -05:00
32997-categories send categories from gitops (#38294) 2026-01-14 11:04:02 -05:00
33005-macvim created mac vim mapping software transformer (#38333) 2026-01-21 12:33:14 -06:00
33272-delete-software-pending-installs-nuance Fleet UI: Clarify delete VPP app pending install nuance (#38376) 2026-01-20 12:49:18 -05:00
33296-disk-encryption Limited disk encryption key escrowing when setting enabled (#39047) 2026-02-02 10:50:30 -06:00
33519-url-team-id-param Fleet UI: Host details page includes team_id param in URL (#39801) 2026-02-13 16:42:17 -05:00
33762-ability-to-set-alternative-browser-host Ability to set fleet desktop alternative browser host in org settings (#38409) 2026-01-19 16:25:22 -04:00
33815-fix-missing-installer-from-inventory-after-wipe-reenroll Bugfix: Fix query to ignore host_software_installs rows where host is deleted (#38250) 2026-01-14 08:32:30 -05:00
33990-rhel-kernel-vulns Scan goval-dict for rhel kernel vulnerabilities(#39749) 2026-02-12 15:21:59 -07:00
34114-packs-page Fleet UI: Styling updates to Packs flow (legacy feature) (#38856) 2026-01-29 09:24:28 -05:00
34122-remove-stable-scrollbar-gutters Remove stable scrollbar gutters from the UI (#39850) 2026-02-13 13:34:02 -08:00
34359-long-script-names-overflow-tables Long script names overflow tables (#38594) 2026-01-23 16:41:53 -04:00
34398-consistent-icon-buttons Fleet UI: Update icon buttons for consistency (#38639) 2026-01-22 17:21:02 -05:00
34501-fix-fleetd-escrow-multi-sessions-x11 🤖 Fix fleetd escrow in X11 multi-user sessions (#39795) 2026-02-16 14:15:10 -03:00
34521-dynamic-scep-challenges-for-okta-certs Dynamic SCEP Challenges For Okta Certs (#38908) 2026-01-28 13:28:39 -08:00
34620-trim-app-fix Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal. (#39563) 2026-02-10 13:03:23 -06:00
34635-fix-cte-syntax-for-frontend Use forked node-sql-parser, fix CTE issues in parsed SQL (#38744) 2026-01-28 16:08:33 -06:00
34748-tooltip-truncated-host-software-type Improve host software inventory table's handling of long "Type" values. (#39732) 2026-02-12 10:15:26 -08:00
34990-improve-apns-query-efficiency improve APNS query efficiency (#39614) 2026-02-10 15:40:44 -05:00
35044-2-vuln-jobs Fix issue with vuln jobs running in parallel. (#39806) 2026-02-16 13:59:40 -06:00
35086-fix-pkg-decoder-error 35086 use charset reader xar (#38459) 2026-01-16 17:19:20 -05:00
35141-table-sizes Optionally output database table sizes after migrations complete (#38620) 2026-01-26 17:55:55 -06:00
35191-git-cve-false-positive Fixed false positive git CVEs (#38657) 2026-01-26 12:35:08 -06:00
35192-imp-correct-classification Differentiate between imp and Integrative Modeling Platform (#38396) 2026-01-20 16:39:50 -06:00
35193-libtiff Libtiff false positive vuln (#38703) 2026-01-23 13:08:58 -07:00
35194-safari-cve-false-positives Fixed Safari cve false positives (#38903) 2026-01-29 15:51:01 -06:00
35281-msrc-companion-apps Fixed false positive for msrc companion apps (#38824) 2026-01-28 13:02:31 -06:00
35366-false-negative-adobe-acrobat-reader-dc False negative vulnerability for Adobe Acrobat Reader DC (#39131) 2026-02-05 07:20:16 -04:00
35447-fix-cpe-translation-error-logging Fixed unnecessary error logging when no CPE match is found (#38754) 2026-01-26 13:52:52 -06:00
35561-move-textarea-copy-icons Move copy UI for InputFields with type="textarea" in line with the label (#39885) 2026-02-16 12:11:40 -08:00
35603-optimize-query-results Improve performance when recording schedule query results (#38524) 2026-01-27 10:33:47 -06:00
35613-android-profiles-pending Put Android profiles in pending immediately on upload (#39330) 2026-02-04 14:18:06 -05:00
35659-android-profiles-dont-reverify Reverify Android profiles that previously failed (#39025) 2026-02-04 13:08:22 -05:00
35717-dont-enqueue-setup-experience-on-previously-enrolled-hosts Don't run setup experience on host that was previously enrolled (#38318) 2026-01-28 08:44:42 -06:00
36069-fix-patch-categories-software-installer Bugfix: patch categories for software installer (#38334) 2026-01-20 09:39:13 -05:00
36313-fix-timestamps-label-and-teams-creation Fix: incorrect timestamps returned for Label and Team creation (#38846) 2026-01-27 18:02:48 -03:00
36324-fix-permission-issue-custom-software-installer-icon Custom software installer icons: fix permission issue (#38326) 2026-01-14 16:24:05 -05:00
36333-android-google-errors Surface Google err message for policy failures after retries (#38923) 2026-02-04 08:16:29 -05:00
36335-7-zip-false-negative-cve Fixed false negative CVE for 7-Zip installed with MSI installer (#38922) 2026-01-28 14:06:13 -06:00
36342-scroll-yml-in-gitops-mode Fleet UI: Allow users to scroll through disabled yml fields (#38715) 2026-01-26 09:35:22 -05:00
36355-activities-max-per_page Max per_page for activities is now 10,000 (#39828) 2026-02-13 13:32:09 -06:00
36361-more-debug-logging-for-ca-profiles add additional logging for SCEP proxy and SCEP profiles (#39501) 2026-02-09 14:46:30 -05:00
36541-missing-vpp-version-add-software Fleet UI: Show VPP version for software setup (#38412) 2026-01-15 21:33:52 -05:00
36755-add-activity-for-modified-enroll-secrets Add activity for modified enroll secrets (#39292) 2026-02-07 09:21:10 -04:00
36770-limit-process-dep-cooldowns limit DEP cooldowns to sync limit and order by oldest first (#38535) 2026-01-21 09:25:55 -05:00
36862-fix-flash-message-link-color Fleet UI: Fixed hover color of links in error flash messages (#38634) 2026-01-22 11:25:21 -05:00
37006-fix-broken-disk-space-sort Fleet UI: Fixed broken disk space sort header on hosts table (#38732) 2026-01-26 09:35:43 -05:00
37008-manual-agent-install-only-blocks-macos-se-software manual agent install should only block macOS SE software (#38434) 2026-01-20 11:37:39 -05:00
37072-dep-sync Update server-proto version to 9, implement THROTTLED w/ 24h cooldown (#38920) 2026-01-29 15:31:28 -05:00
37111-ninxsoft-mist-cve Fixed CVE false positive on ninxsoft/Mist. (#38849) 2026-01-28 07:06:39 -06:00
37130-archived-disk-err-msg Add error message for decryption failures (#38919) 2026-02-03 17:08:44 -05:00
37146-create-builtin-label-error-msg Fix: Show error reason when trying to edit a label that conflicts with a built-in label name (#39259) 2026-02-03 17:24:28 -03:00
37155-force-end-user-authentication-host-reenrollment Fix: Deleting a host from Fleet does not delete related IdP records (#38530) 2026-01-28 10:10:00 -03:00
37182-update-policy-membership-when-labels-change Update policy membership when policy labels change (#39201) 2026-02-11 08:56:01 -06:00
37183-unclear-missing-label-error improve missing label error message (#38636) 2026-01-26 12:55:26 -05:00
37219-fix Add help text below InstallerStatusTable to explain the meanings of counts (#38994) 2026-02-05 17:11:09 +01:00
37264-gitops-fma-icons Use custom icons in GitOps for Fleet Maintained Apps (#38497) 2026-01-20 11:56:40 -05:00
37278-okta-fail-my-device-page Redirect to my device page if device fails okta cond. access (#38342) 2026-01-15 11:02:35 -05:00
37290-fix-xcode-vpp-verification Bugfix: apply a special-case for Xcode VPP app verification (#38539) 2026-01-21 17:16:13 -05:00
37464-installer-size Bump installer max size, make configurable (#38122) 2026-01-19 13:36:01 -06:00
37508-gitops-team-software-display_name GitOps: Allow team yml to apply display_name to software package (#38364) 2026-01-20 09:32:25 -05:00
37597-ignore-build-version-compare Fleet UI: Strip build from compareVersion x.x (build x.x) (#38433) 2026-01-16 10:59:46 -05:00
37710-package-parsing Compare pkg-info bundle id with bundles in pkg parsing (#38577) 2026-01-21 13:43:38 -05:00
37804-filtering-fmas Fleet UI: Add Software > FMA table - Add platform and status filter (#37805) 2026-02-04 09:16:11 -05:00
37806-fleet-activities Activity bounded context: /api/latest/fleet/activities (1 of 2) (#38115) 2026-01-19 09:07:14 -05:00
37944-gzip-responses Add gzip support to API handlers (#38675) 2026-01-29 08:21:18 -03:00
37957-pgadmin-vulnerability Fixed false negative CVE for pgAdmin 4. (#38813) 2026-01-28 13:30:44 -06:00
38035-android-reenroll Android app re-enroll on 401 (#38690) 2026-01-27 09:01:01 -07:00
38094-ability-to-set-alternative-browser-host Ability to set fleet desktop alternative browser host in org settings (#38409) 2026-01-19 16:25:22 -04:00
38096-alternative-browser-host-gitops Alternative browser host gitops (#38516) 2026-01-21 10:12:48 -04:00
38205-remove-incorrect-eua-warning-for-macos gate orbit enrollment to windows/linux only (#38207) 2026-01-14 08:41:50 -06:00
38343-use-custom-icon-display-name-in-setup-experience Bugfix: use custom software title icon and display name in setup experience UI (#39223) 2026-02-03 14:56:16 -05:00
38369-ui-mdm-commands-off Hide host MDM commands activity UI when MDM is turned off (#38394) 2026-01-16 11:03:22 -06:00
38431-enforce-setup-experience-restrictions Enforce GitOps setup experience when manual agent install is enabled (#39775) 2026-02-13 16:21:39 -05:00
38452-display-name move deletion into block that only executes when the package itself changes (#38595) 2026-01-21 16:59:40 -05:00
38473-add-ipad-screenshot-in-lock-modal Display iPad screenshot in lock modal (#38475) 2026-01-20 13:26:01 +01:00
38479-otel-shutdown Improved OpenTelemetry tracing (#38483) 2026-01-20 12:22:20 -06:00
38484-fleet-dev-env-vars Only allow FLEET_DEV_* env vars when --dev is passed, allow overriding configs one at a time in dev (#38652) 2026-01-27 14:32:56 -06:00
38514-android-mdm-empty-state Fleet UI: Show CTA to turn on Android MDM (#39763) 2026-02-13 09:20:56 -05:00
38534-fleet-activities-2 Activity bounded context: Complete read operations (#38555) 2026-02-09 15:29:12 -06:00
38543-disk-encryption-miscounts 38543 disk encryption miscount (#39497) 2026-02-06 14:45:58 -05:00
38549-okta-cond-access-cert-format Added conditional_access.cert_serial_format server option to allow specifying the Okta conditional access certificate serial format. (#38697) 2026-01-26 12:21:10 -06:00
38554-populate-idp-host-vitals-android Fix: IdP host vitals not automatically populated for Android hosts (#39254) 2026-02-06 09:15:30 -03:00
38557-read-users Global observers and maintainers can now officially read user details (#38558) 2026-01-21 13:55:10 -06:00
38579-micromdm-scep-fix Porting fix from micromdm/scep (#38638) 2026-01-22 13:34:53 -06:00
38582-settings-integration-unfinish-setup-breaks-ui Unfinished Entra integration setup breaks UI (#38847) 2026-02-02 15:29:04 -04:00
38607-otel-logs Added OTEL log export support (#39279) 2026-02-06 18:57:28 -06:00
38621-add-technician-role Add new Technician role (#39564) 2026-02-11 15:00:10 -03:00
38622-vpp-metadata-api-server-config Expose VPP metadata bearer token as public config, interact directly with Apple when set (#38817) 2026-01-27 16:50:40 -06:00
38666-hosts-ui-bug #38666: Fix host list UI "jumping" bug (#39022) 2026-01-29 17:02:31 -06:00
38704-fail-ipa-installs Fail in-house app installs when host unenrolls (#38803) 2026-01-26 15:45:52 -05:00
38756-otel-client-errors Improved OpenTelemetry error handling (#38757) 2026-01-26 17:07:32 -06:00
38766-uninstall-android-apps-on-fleet-remove RAA: Support removing an android app from managed google play (self-service) on deletion (#39343) 2026-02-11 11:35:00 -05:00
38834-update-apple-os-update-time Change OS update deadline to 7PM local time (#38810) 2026-02-03 09:42:12 -05:00
38878-fully-managed-android Add support for fully-managed android devices (#39388) 2026-02-06 10:46:25 -05:00
38880-capture-mdm-enroll-ref-for-ios-ipados Capture MDM enroll reference for iOS and IPadOS devices (#39020) 2026-01-30 13:38:01 -06:00
38889-slog-1 Migrate HTTP request logging from go-kit/log to slog (#39729) 2026-02-14 13:04:41 -06:00
38911-nextcloud-cve Fixed false positive CVE for Nextcloud Desktop (#39360) 2026-02-05 13:13:38 -06:00
38975-all-teams account for all teams as a value for vpp teams (#39013) 2026-01-29 17:04:02 -05:00
39000-ca-bypass-per-policy UI: Allow conditional access bypass per-policy (#39667) 2026-02-11 18:55:59 -08:00
39044-gitops-cal Bugfix: gitops-generate panics when google calendar config is set (#39237) 2026-02-04 14:04:08 -07:00
39048-only-default-if-update-new-hosts-not-explictly-set Only default update_new_hosts key if not explicitly set (#39202) 2026-02-03 12:41:52 -05:00
39083-gitops-label-platform-validation Label validation not catching invalid platform (#39964) 2026-02-17 14:04:07 -04:00
39158-cert-auth Fixed certificate auth serialization (#39287) 2026-02-04 11:54:53 -06:00
39215-refetch only refetch location data if iDevice is locked (#39241) 2026-02-04 09:23:44 -05:00
39228-db-failover Improve error handling on AWS DB failover (#39841) 2026-02-17 07:10:52 -06:00
39264-entra-tenants Add entra tenant IDs migration (#39420) 2026-02-09 12:48:19 -05:00
39273-filter-button-hover-fix Fix label button hover state (#39425) 2026-02-06 11:06:22 -06:00
39293-smallstep-basic-auth Added changes and test to contributor's fix. (#39390) 2026-02-05 13:13:08 -06:00
39329-rename-teams-and-queries Rename teams and queries to fleets and reports in UI (#39572) 2026-02-17 15:19:33 -06:00
39419-disable-gitops-edit-fma Fleet UI (GitOps Mode): Disable edit software modal fields for FMAs, add GitOps tooltips on Save buttons (#39335) 2026-02-06 11:19:35 -05:00
39423-left-align-critical-checkbox-save-policy Left align Critical checkbox in Save policy modal (#39786) 2026-02-13 16:42:09 -03:00
39437-tarballs-ui-status Fleet UI: Tarballs and script packages skip recent updates UI statuses (#39437) 2026-02-11 14:07:11 -05:00
39522-build-workflow 🤖 Improve build version population based on git branch (#39523) 2026-02-09 08:43:02 -06:00
39608-server-worker Reworked how we handle server/worker delays to fix flaky tests (#39609) 2026-02-10 20:26:43 -06:00
39613-host-name-not-displayed-hostpage-software-tab Fixed bug with Host detail software tab page title (#39941) 2026-02-17 13:20:24 -04:00
39634-bootstrap-migration Add EV to allow bootstrap package install during migration (#39648) 2026-02-11 08:38:11 -05:00
39687-read-replica-tls Fix issue where MySQL read replicas were not using TLS. (#39689) 2026-02-11 12:08:21 -06:00
39737-dup-kernel Remove duplicate RHEL kernel in os_version (#39746) 2026-02-12 09:13:24 -07:00
39794-alphabetize-host-vitals Dynamically alphabetize vitals on the host details page (#39946) 2026-02-16 15:31:20 -08:00
260110-known-mdm-iru Add Iru to list of well known MDMs (#38144) 2026-02-02 19:42:28 -06:00
add-trusted-proxies-config Implement trusted proxies config (#38471) 2026-01-19 22:13:37 -06:00
clear-sessions-and-tokens-on-password-change Clear reset tokens and user sessions after password change (#38999) 2026-02-03 11:14:10 -06:00
go-1.25.7 Update to Go 1.25.7 (#39584) 2026-02-09 17:47:51 -06:00
issue-36935-better-message-error-token improve err message when getting android enrollment token during ota enrollment (#38428) 2026-01-16 16:43:19 +00:00
issue-37371-not-now-status handle NotNow status from device so that it does not block the DEP setup experience flow (#38319) 2026-01-21 15:14:57 +00:00