starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: Provide whitelist for SSRF filtering #2432

New Issue
Closed
opened 2026-04-25 00:07:04 +02:00 by adam · 2 comments
adam commented 2026-04-25 00:07:04 +02:00
Owner
Copy Link
Copy Source

Originally created by @mgrecar on GitHub (Dec 22, 2024).

Type of Enhancement

Server Backend

Describe the Feature/Enhancement

Provide a configurable way to leave SSRF filtering intact, i.e. DISABLE_SSRF_REQUEST_FILTER=0, but allow explicit exceptions. This would allow for self-hosting feeds on the local network (like re-hosting filtered podcasts with something like RSS-lambda or RSS-Bridge), without just disabling the security feature entirely with DISABLE_SSRF_REQUEST_FILTER=0.

Why would this be helpful?

As previously discussed and addressed in https://github.com/advplyr/audiobookshelf/issues/2549, we can now at least decide to turn it off if we need that capability, but disabling it completely to allow a single trusted self-hosted source feels like a blunt hammer.

The only current options I'm aware of are:

  1. Don't consume self-hosted content.
  2. Disable protection from SSRF attacks.
  3. Set up another independent network, either self-hosted or cloud, leaving ABS on one and your self-hosted content on the other.

Future Implementation (Screenshot)

Personally, I'd be perfectly happy with an env var like SSRF_SOURCE_WHITELIST or something, and just supply a comma-separated list of sources that ABS bypasses the SSRF restriction on.

So, you might specify in a Docker Compose file the following to bypass SSRF on 2 specific subdomains:

environment:
  - SSRF_SOURCE_WHITELIST=rss-lambda.mydomain.net,rss-bridge.mydomain.net

Audiobookshelf Server Version

v2.17.5

Current Implementation (Screenshot)

There's really no current implementation to reference here.

Originally created by @mgrecar on GitHub (Dec 22, 2024). ### Type of Enhancement Server Backend ### Describe the Feature/Enhancement Provide a configurable way to leave SSRF filtering intact, i.e. `DISABLE_SSRF_REQUEST_FILTER=0`, but allow explicit exceptions. This would allow for self-hosting feeds on the local network (like re-hosting filtered podcasts with something like [RSS-lambda](https://github.com/sekai-soft/rss-lambda) or [RSS-Bridge](https://github.com/RSS-Bridge/rss-bridge)), without just disabling the security feature entirely with `DISABLE_SSRF_REQUEST_FILTER=0`. ### Why would this be helpful? As previously discussed and addressed in https://github.com/advplyr/audiobookshelf/issues/2549, we can now at least decide to turn it off if we need that capability, but disabling it completely to allow a single trusted self-hosted source feels like a blunt hammer. The only current options I'm aware of are: 1. Don't consume self-hosted content. 2. Disable protection from SSRF attacks. 3. Set up another independent network, either self-hosted or cloud, leaving ABS on one and your self-hosted content on the other. ### Future Implementation (Screenshot) Personally, I'd be perfectly happy with an env var like `SSRF_SOURCE_WHITELIST` or something, and just supply a comma-separated list of sources that ABS bypasses the SSRF restriction on. So, you might specify in a Docker Compose file the following to bypass SSRF on 2 specific subdomains: ``` environment: - SSRF_SOURCE_WHITELIST=rss-lambda.mydomain.net,rss-bridge.mydomain.net ``` ### Audiobookshelf Server Version v2.17.5 ### Current Implementation (Screenshot) There's really no current implementation to reference here.
adam added the enhancement label 2026-04-25 00:07:04 +02:00
adam closed this issue 2026-04-25 00:07:04 +02:00
adam commented 2026-04-25 00:07:04 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Dec 24, 2024):

I went with SSRF_REQUEST_FILTER_WHITELIST

So that's

SSRF_REQUEST_FILTER_WHITELIST=rss-lambda.mydomain.net,rss-bridge.mydomain.net

If DISABLE_SSRF_REQUEST_FILTER is set to 1 it will take precedence and disable the ssrf request filter for all URLs.

The whitelist is only the hostname. No port, no protocol.

@advplyr commented on GitHub (Dec 24, 2024): I went with `SSRF_REQUEST_FILTER_WHITELIST` So that's ``` SSRF_REQUEST_FILTER_WHITELIST=rss-lambda.mydomain.net,rss-bridge.mydomain.net ``` If `DISABLE_SSRF_REQUEST_FILTER` is set to `1` it will take precedence and disable the ssrf request filter for all URLs. The whitelist is only the hostname. No port, no protocol.
adam commented 2026-04-25 00:07:05 +02:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Dec 30, 2024):

Fixed in v2.17.6.

@github-actions[bot] commented on GitHub (Dec 30, 2024): Fixed in [v2.17.6](https://github.com/advplyr/audiobookshelf/releases/tag/v2.17.6).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2432
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?