starred/yaak-mountain-loop
1
0
Fork 0
mirror of https://github.com/mountain-loop/yaak.git synced 2026-08-26 21:34:07 +02:00
Code Issues 8 Packages Projects Releases 10 Wiki Activity

Refuse private ranges unconditionally; the proxy's network is never the user's

Browse Source
This commit is contained in:
Gregory Schier
2026-08-17 11:00:39 -07:00
parent 58d625cc39
commit 679e49d1eb
5 changed files with 17 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates-server/yaak-send-proxy/src/config.rs
-12
View File
@@ -22,18 +22,6 @@ pub struct Config {
)]
pub allowed_origins: Vec<String>,
/// Allow sends to private, loopback, link-local and other non-public addresses.
///
/// Off by default: a hosted instance must not become a relay into its own network. A
/// self-hosted instance on a private network legitimately needs this on to reach the
/// services next to it.
#[arg(
long,
env = "YAAK_PROXY_ALLOW_PRIVATE_NETWORKS",
default_value_t = false
)]
pub allow_private_networks: bool,
/// Largest request the proxy accepts from the tab (the rendered request JSON, body included).
#[arg(long, env = "YAAK_PROXY_MAX_REQUEST_BYTES", default_value_t = 16 * 1024 * 1024)]
pub max_request_bytes: usize,