From f85d5a55700cf0ba0aa96cdabb4a90bcfe256823 Mon Sep 17 00:00:00 2001 From: r888888888 Date: Tue, 18 Aug 2015 12:45:10 -0700 Subject: [PATCH] addresses #2498: revised implementation --- app/logical/downloads/file.rb | 2 +- config/danbooru_default_config.rb | 14 +++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/app/logical/downloads/file.rb b/app/logical/downloads/file.rb index cfae3e5a2..6b15504eb 100644 --- a/app/logical/downloads/file.rb +++ b/app/logical/downloads/file.rb @@ -64,7 +64,7 @@ module Downloads end def validate_local_hosts(url) - ip_addr = Resolv.getaddress(url.hostname) + ip_addr = IPAddr.new(Resolv.getaddress(url.hostname)) if Danbooru.config.banned_ip_for_download?(ip_addr) raise Error.new("Banned server for download") end diff --git a/config/danbooru_default_config.rb b/config/danbooru_default_config.rb index 542d2c3a2..df03b6845 100644 --- a/config/danbooru_default_config.rb +++ b/config/danbooru_default_config.rb @@ -362,7 +362,19 @@ module Danbooru # For downloads, if the host matches any of these IPs, block it def banned_ip_for_download?(ip_addr) - ip_addr =~ /^(?:127\.0\.0\.1|::1|169\.254\.\d+\.\d+|fe80::.*)$/ + raise ArgumentError unless ip_addr.is_a?(IPAddr) + + if IPAddr.new("127.0.0.1") == ip_addr + true + elsif IPAddr.new("169.254.0.0/16").include?(ip_addr) + true + elsif IPAddr.new("::1") == ip_addr + true + elsif IPAddr.new("fe80::/10").include?(ip_addr) + true + else + false + end end end end