private_address_check | Ruby gem to help prevent Server Side Request | Application Framework library

by jtdowney Ruby Version: Current License: MIT

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | private_address_check Summary

private_address_check is a Ruby library typically used in Server, Application Framework, Ruby On Rails applications. private_address_check has no bugs, it has a Permissive License and it has low support. However private_address_check has 3 vulnerabilities. You can download it from GitLab, GitHub.

Ruby gem to help prevent Server Side Request Forgery

Support

Quality

Security

License

Reuse

Support

private_address_check has a low active ecosystem.

It has 38 star(s) with 8 fork(s). There are 2 watchers for this library.

It had no major release in the last 6 months.

There are 0 open issues and 2 have been closed. On average issues are closed in 0 days. There are 1 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of private_address_check is current.

Quality

private_address_check has 0 bugs and 0 code smells.

Security

private_address_check has 3 vulnerability issues reported (1 critical, 1 high, 0 medium, 1 low).

private_address_check code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

private_address_check is licensed under the MIT License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

private_address_check releases are not available. You will need to build from source code and install.

Installation instructions, examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of private_address_check

Get all kandi verified functions for this library.

private_address_check Key Features

No Key Features are available at this moment for private_address_check.

private_address_check Examples and Code Snippets

No Code Snippets are available at this moment for private_address_check.

Community Discussions

Trending Discussions on Application Framework

What is meant by required-api: param name=”#target” in config.xml file of AGL widgets?

QUESTION

What is meant by required-api: param name=”#target” in config.xml file of AGL widgets?

Asked 2020-Mar-06 at 09:53

I am trying to understand various available AGL specific options that we can give in config.xml and I am referring to the link below

https://docs.automotivelinux.org/docs/en/halibut/apis_services/reference/af-main/2.2-config.xml.html

This is the sample config.xml file

...

ANSWER

Answered 2020-Mar-06 at 09:48

I figured out why we need this

required-api: param name="#target"

OPTIONAL(not compulsory)

It declares the name of the unit(in question it is main) requiring the listed apis. Only one instance of the param “#target” is allowed. When there is not instance of this param, it behave as if the target main was specified.

Source https://stackoverflow.com/questions/60561230

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

CVE-2018-3759 LOW

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.

https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147

CVE-2017-0909 CRITICAL

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

https://hackerone.com/reports/288950

https://github.com/jtdowney/private_address_check/pull/3

CVE-2017-0904 HIGH

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.

https://hackerone.com/reports/287835

https://hackerone.com/reports/287245

https://github.com/jtdowney/private_address_check/issues/1

https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af

https://edoverflow.com/2017/ruby-resolv-bug/

Install private_address_check

Add this line to your application's Gemfile:.

Support

Bug reports and pull requests are welcome on GitHub at https://github.com/jtdowney/private_address_check. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

Find more information at: