mirror of
https://github.com/advplyr/audiobookshelf.git
synced 2026-05-30 23:40:40 +02:00
[Bug]: download some rss feed error with v2.5.0 #1495
Assignees
adam (Adam Melkus)
Clear assignees
adam (Adam Melkus)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/audiobookshelf#1495
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Rookiewan on GitHub (Oct 31, 2023).
Describe the issue
My rss feed is generate by RssHub http://192.168.6.220:1200/163/music/djradio/12,It worked fine in previous versions.
Steps to reproduce the issue
Audiobookshelf version
v2.5.0
How are you running audiobookshelf?
Docker
@advplyr commented on GitHub (Oct 31, 2023):
Due to the security advisory submitted here https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-mgj7-rfx8-vhpr I added an SSRF request filter. https://github.com/y-mehta/ssrf-req-filter
That validates the path being entered is external. I suppose we could allow for disabling that at the users own risk so will leave this open for now to see if anyone has thoughts.
@Rookiewan commented on GitHub (Nov 1, 2023):
Thank you, I understand, but now I don't know how to make it available.
@advplyr commented on GitHub (Nov 1, 2023):
You can use a reverse proxy and serve it over https
@fmillion-mnsu commented on GitHub (Apr 21, 2024):
Came here from my issue. I definitely need the ability to load podcasts from internal network IP addresses. I would definitely like an option to allow internal IPs on podcast downloads with a link to info on SSRF. Alternatively, some sort of DNS or IP address allowlist would work and arguably be more secure, since you would explicitly state which internal IP address the podcast is hosted at and allow only that IP address.
@midasvo commented on GitHub (Apr 24, 2024):
I host an application locally that serves podcast feeds and I do not want to expose this to the internet. Would really appreciate a way to toggle this setting or whitelist a container name / ip.
@advplyr commented on GitHub (Apr 25, 2024):
I updated this issue to an enhancement for adding that server setting: https://github.com/advplyr/audiobookshelf/issues/2549
I'll try to get this in the next release
@MaxTan commented on GitHub (May 24, 2024):
use reverse proxy and services it over https still prompts failure.
log:
[podcastUtils] getPodcastFeed Error Error: Call to 192.168.1.2 is blocked.@fmillion-mnsu commented on GitHub (Jun 3, 2024):
yes, it looks like the ssrf-filter plugin is the "nuclear option" as it simply blocks ALL connections based on IP address, https/dns/etc. don't even matter to that filter. (it's also a very hacky way of implementing an ssrf filter to begin with.) ssrf-filter actually uses ipaddr.js which has its own issues with IP address classification.
The easy short-term fix is simply an environment variable that allows you to disable ssrf-filter. A better option would be an allowlist for domains or IP addresses that bypass any filtering.
I might dig into the code at some point to see if I can implement it, but in the meantime I ended up having to host my podcast feed on one of my DigitalOcean instances. I use Traefik so I just setup a service pointing to my internal server via my VPN, and added an IP whitelist filter so that only the egress IP of my ABS server can actually access the rss feed and audio files, but this still ends up creating a "round-trip" (ABS -> internet -> DigitalOcean -> VPN -> LAN WWW server).
@advplyr commented on GitHub (Jun 4, 2024):
That env variables was easy to add I just forgot about it. I just added it
It will be on
edgedocker image if you want to use that before the next releaseSet env variable
DISABLE_SSRF_REQUEST_FILTERto1