[hansott]

As we don't report them

[aikido-pr-checks]

🔵 Low - Bracketed IPv6 URLs remain blocked in outbound lockdown

An application makes an HTTP(S) request to a literal IPv6 URL such as http://[::1]:8080 while new outbound connections are blocked. URLCollector and the DNS advice preserve the bracketed host, but IPValidator.isIP does not accept brackets, so DNSRecordCollector still applies the unknown-host outbound rule and throws BlockedOutboundException. This contradicts the PR's literal-IPv6 exemption and can prevent legitimate direct IPv6 connections from being made.

Show fix

Suggested change

	} else if (!IPValidator.isIP(hostname)) {
	// Skip literal IPs with no pending port: usually inbound IP parsing rather than an outbound request,
	// and we can't tell them apart here. A real outbound one still hits the blocking/SSRF checks below.
	// and we can't tell them apart here. A real outbound one still hits the SSRF checks below.
	HostnamesStore.incrementHits(hostname, 0);
	}
	// Checked here, not at the HTTP client, since not all clients are instrumented and port/context isn't always available.
	if (ServiceConfigStore.shouldBlockOutgoingRequest(hostname)) {
	if (!IPValidator.isIP(hostname) && ServiceConfigStore.shouldBlockOutgoingRequest(hostname)) {
	logger.debug("Blocking DNS lookup for domain: %s", hostname);
	throw BlockedOutboundException.get();
	}
	} else if (!IPValidator.isIP(hostname)
	&& !(hostname.startsWith("[")
	&& hostname.endsWith("]")
	&& IPValidator.isIP(hostname.substring(1, hostname.length() - 1)))) {
	// Skip literal IPs with no pending port: usually inbound IP parsing rather than an outbound request,
	// and we can't tell them apart here. A real outbound one still hits the SSRF checks below.
	HostnamesStore.incrementHits(hostname, 0);
	}
	// Checked here, not at the HTTP client, since not all clients are instrumented and port/context isn't always available.
	if (!IPValidator.isIP(hostname)
	&& !(hostname.startsWith("[")
	&& hostname.endsWith("]")
	&& IPValidator.isIP(hostname.substring(1, hostname.length() - 1)))
	&& ServiceConfigStore.shouldBlockOutgoingRequest(hostname)) {
	logger.debug("Blocking DNS lookup for domain: %s", hostname);
	throw BlockedOutboundException.get();
	}

_{More info - Reply on this comment to give feedback or ignore the issue.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!