Automated Template Builds, Proxmox User ACLs, Improved LDAP Integration by runleveldev · Pull Request #189 · mieweb/opensource-server

runleveldev · 2026-02-10T15:11:34Z

No description provided.

create-a-container/utils/docker-registry.js

+    const req = https.get(url, { headers }, (res) => {
+      // Handle redirects
+      if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 307 || res.statusCode === 308) {
+        const location = res.headers.location;
+        if (!location) {
+          return reject(new Error(`Redirect without Location header (status ${res.statusCode})`));
+        }
+        // Follow redirect (without auth headers for CDN)
+        return httpGet(location, {}, redirectCount + 1)
+          .then(resolve)
+          .catch(reject);
+      }
+
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        if (timedOut) return;
+        resolve({ statusCode: res.statusCode, headers: res.headers, body: data });
+      });
+    });


In general, to fix SSRF you must prevent untrusted input from freely controlling the destination of outbound HTTP(S) requests. For this code, that means: (1) validating and constraining the registry hostname derived from the image parameter, and (2) optionally tightening redirect following so we don’t escape those constraints via Location headers. The intent here is to fetch metadata from Docker/OCI registries; we can keep that functionality by enforcing that only safe registry hosts are allowed (e.g., public registries or a configured set) and by rejecting image references that specify arbitrary hosts.

The single best fix with minimal behavioral change is to introduce a small validator in docker-registry.js that checks a registry hostname against an allow‑list / safety rules and to apply it before using registry/registryHost to build URLs. Specifically:

Add a helper isRegistryHostAllowed(host) that:

Ensures the host is a syntactically valid hostname or IPv4/IPv6 literal.

Rejects hostnames that resolve to private/bogon IP ranges (RFC1918, loopback, link‑local, etc.) to prevent access to internal networks.

Optionally, you can tighten further by allowing only a configured set like docker.io, registry-1.docker.io, ghcr.io, etc. (I’ll implement a conservative allow‑list plus internal-IP blocking).

Use Node’s built-in dns.promises.lookup / net module to check resolved IPs, since we are allowed to import standard libraries.

In getImageConfig(registry, repo, tag), before constructing registryHost and URLs, call isRegistryHostAllowed(registryHost) and throw an error (or return an HTTP 400 via the caller) if it fails. This is the main path used by GET /metadata.

Optionally, add a similar check to any other function that constructs registry URLs with potentially user-controlled hostnames, but within the given snippets only getImageConfig is directly in the flow.

Because getImageConfig is already async, we can comfortably make the validator async and await it. We’ll add the required imports (dns and net) at the top of docker-registry.js and keep everything else intact. This change preserves existing behavior for normal public registries, but prevents users from forcing the backend to call arbitrary/internal hosts.

cmyers-mieweb · 2026-02-11T22:22:41Z

Talked with Robert a bit and suggested adding some core packages to the Dockerfile, whether it be anything from tmux, jq, git, etc. Items that are commonly used to save time.

runleveldev added 2 commits February 10, 2026 09:50

fix: add last_name and first_name to ldap sql query

7d7514b

fix: trim leading/trailing spaces in names

eff1ffa

This was linked to issues Feb 10, 2026

[Bug]: LDAP server implementation doesn't expose Firstname #188

Open

Normal (non-administrator) users can delete their own containers outside of the API server #152

Open

runleveldev changed the title ~~Sprint~~ LDAP Improvements Feb 10, 2026

runleveldev added 6 commits February 10, 2026 10:13

feat: add ACL for user when creating container

8651167

refactor: remove unused subprojects

e8893eb

feat: base Debian 13 build

fc20514

fix: increase body limit for application support

8f5ccbb

feat: add ldap-gateway for local ldap integration testing

4ba433d

feat: configure ldap autoconfiguration based on rootDSE

d00911c

runleveldev linked an issue Feb 10, 2026 that may be closed by this pull request

Run Packer Build on a Schedule from the job-runner #120

Open

runleveldev mentioned this pull request Feb 10, 2026

120 run packer build on a schedule from the job runner #184

Closed

feat: automatted docker image builds

e2f9755

runleveldev changed the title ~~LDAP Improvements~~ Automated Template Builds, Proxmox User ACLs, Improved LDAP Integration Feb 10, 2026

feat: update web-gui docs

fcee3c2

runleveldev force-pushed the sprint branch from d7c65d0 to d102e2e Compare February 10, 2026 21:16

feat: carry container environment variables into userspace

58afed1

runleveldev force-pushed the sprint branch 2 times, most recently from 009f4cb to edee54e Compare February 11, 2026 15:13

feat: nodejs base image and Bakefile integration

4199984

runleveldev force-pushed the sprint branch from edee54e to 4199984 Compare February 11, 2026 15:18

feat: prepopulate image information from registry

d8b94c7

github-advanced-security bot found potential problems Feb 11, 2026

View reviewed changes

runleveldev added 4 commits February 11, 2026 11:26

feat: add docker label support for declaring http services

1890158

fix: buildx context fixes

d174f89

feat: add additional default packages

9a93bec

fix: improve reliablility by deploying 2 ldap servers

5e97abe

@@ -7,8 +7,87 @@
              */
             const https = require('https');
+            const dns = require('dns').promises;
+            const net = require('net');
             /**
+             * Determine if an IP address is private or loopback/link-local.
+             * This is used to prevent SSRF to internal network resources.
+             * @param {string} ip
+             * @returns {boolean}
+             */
+            function isPrivateIp(ip) {
+              if (!ip || typeof ip !== 'string') return false;
+              // IPv6 loopback or link-local/site-local
+              if (ip === '::1' || ip.startsWith('fe80:') || ip.startsWith('fc00:') || ip.startsWith('fd00:')) {
+                return true;
+              }
+              const parts = ip.split('.');
+              if (parts.length !== 4) {
+                return false;
+              }
+              const [a, b] = parts.map(n => parseInt(n, 10));
+              if (a === 10) return true;                 // 10.0.0.0/8
+              if (a === 127) return true;                // 127.0.0.0/8
+              if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12
+              if (a === 192 && b === 168) return true;   // 192.168.0.0/16
+              if (a === 169 && b === 254) return true;   // 169.254.0.0/16 (link-local)
+              return false;
+            }
+            /**
+             * Validate that a registry hostname is safe to contact.
+             * Rejects internal/loopback IPs and hostnames that resolve to them.
+             * @param {string} host
+             * @returns {Promise<void>} Resolves if allowed, rejects otherwise.
+             */
+            async function isRegistryHostAllowed(host) {
+              if (!host || typeof host !== 'string') {
+                throw new Error('Invalid registry host');
+              }
+              // Basic hostname / IPv4 / IPv6 literal check
+              if (!net.isIP(host)) {
+                const hostnameRegex = /^(?=.{1,253}$)(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*$/;
+                if (!hostnameRegex.test(host)) {
+                  throw new Error('Disallowed registry host');
+                }
+              }
+              // Optional allow-list for known public registries; extend as needed.
+              const allowedHosts = new Set([
+                'docker.io',
+                'registry-1.docker.io',
+                'ghcr.io',
+                'quay.io'
+              ]);
+              // Allow explicit entries in the public allow-list without DNS checks.
+              if (allowedHosts.has(host)) {
+                return;
+              }
+              // Resolve host and ensure it does not point to private/internal IPs.
+              try {
+                const lookupResult = await dns.lookup(host, { all: true });
+                for (const addr of lookupResult) {
+                  if (isPrivateIp(addr.address)) {
+                    throw new Error('Registry host resolves to a private or loopback IP, which is not allowed');
+                  }
+                }
+              } catch (err) {
+                if (err.code === 'ENOTFOUND') {
+                  throw new Error('Registry host not found');
+                }
+                throw err;
+              }
+            }
+            /**
              * Low-level HTTP GET that returns status, headers, and body without throwing on 4xx
              * @param {string} url - The URL to fetch
              * @param {object} headers - Optional request headers
@@ -243,6 +320,9 @@
              */
             async function getImageConfig(registry, repo, tag) {
               const registryHost = registry === 'docker.io' ? 'registry-1.docker.io' : registry;
+              // SSRF protection: ensure the resolved registry host is allowed.
+              await isRegistryHostAllowed(registryHost);
               // First, fetch the manifest to get the config digest
               const acceptHeaders = {

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Automated Template Builds, Proxmox User ACLs, Improved LDAP Integration#189

Automated Template Builds, Proxmox User ACLs, Improved LDAP Integration#189
runleveldev wants to merge 17 commits intomainfrom
sprint

runleveldev commented Feb 10, 2026

Uh oh!

Check failure

Copilot Autofix

cmyers-mieweb commented Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

runleveldev commented Feb 10, 2026

Uh oh!

Check failure

Uh oh!

Uh oh!

Copilot Autofix

cmyers-mieweb commented Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants