Add security hardening and PostgreSQL 18 upgrade support

Add ALLOWED_HOSTS configuration to restrict trusted hosts in TrustedHostMiddleware. Enhance SSRF protection to block all private, loopback, link-local, multicast, reserved, and unspecified IP addresses using ipaddress module and DNS resolution checks. Add encrypt_value/decrypt_value aliases for encryption functions. Upgrade PostgreSQL from 16 to 18.4 in Docker Compose with updated data directory path (/var/lib/postgresql). Add security_opt no
2026-06-21 09:44:47 +02:00
parent d694c8b8e3
commit dfec7976c4
8 changed files with 78 additions and 20 deletions
@@ -24,6 +24,10 @@ def test_mask_secret():
 def test_ssrf_protection():
    assert not is_safe_url("http://localhost:8000")
    assert not is_safe_url("http://127.0.0.1/admin")
+    assert not is_safe_url("http://10.0.0.1/admin")
+    assert not is_safe_url("http://172.16.0.1/admin")
+    assert not is_safe_url("http://192.168.1.1/admin")
+    assert not is_safe_url("http://[::1]/admin")
    assert not is_safe_url("http://169.254.169.254")
    assert not is_safe_url("ftp://example.com")
    assert is_safe_url("https://example.com/api")