awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feature: add general env var for allowing internal ip connections and update relevant docs

Browse Source
This commit is contained in:
Scott Wilson
2025-04-14 14:04:26 -07:00
parent ac8b3aca60
commit 499ff3635b
6 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts
View File

@@ -42,7 +42,7 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) =
inputHostIps.push(...resolvedIps); inputHostIps.push(...resolvedIps);
} }
if (!isGateway && !appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP) { if (!isGateway && !(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) {
const isInternalIp = inputHostIps.some((el) => isPrivateIp(el)); const isInternalIp = inputHostIps.some((el) => isPrivateIp(el));
if (isInternalIp) throw new BadRequestError({ message: "Invalid db host" }); if (isInternalIp) throw new BadRequestError({ message: "Invalid db host" });
} }

1
backend/src/lib/config/env.ts
View File

@@ -197,6 +197,7 @@ const envSchema = z
/* ----------------------------------------------------------------------------- */ /* ----------------------------------------------------------------------------- */
/* App Connections ----------------------------------------------------------------------------- */ /* App Connections ----------------------------------------------------------------------------- */
ALLOW_INTERNAL_IP_CONNECTIONS: zodStrBool.default("false"),
// aws // aws
INF_APP_CONNECTION_AWS_ACCESS_KEY_ID: zpStr(z.string().optional()), INF_APP_CONNECTION_AWS_ACCESS_KEY_ID: zpStr(z.string().optional()),

9
backend/src/lib/validator/validate-url.ts
View File

@@ -2,10 +2,16 @@ import dns from "node:dns/promises";
import { isIPv4 } from "net"; import { isIPv4 } from "net";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError } from "../errors"; import { BadRequestError } from "../errors";
import { isPrivateIp } from "../ip/ipRange"; import { isPrivateIp } from "../ip/ipRange";
export const blockLocalAndPrivateIpAddresses = async (url: string) => { export const blockLocalAndPrivateIpAddresses = async (url: string) => {
const appCfg = getConfig();
if (appCfg.isDevelopmentMode) return;
const validUrl = new URL(url); const validUrl = new URL(url);
const inputHostIps: string[] = []; const inputHostIps: string[] = [];
if (isIPv4(validUrl.host)) { if (isIPv4(validUrl.host)) {
@@ -18,7 +24,8 @@ export const blockLocalAndPrivateIpAddresses = async (url: string) => {
inputHostIps.push(...resolvedIps); inputHostIps.push(...resolvedIps);
} }
const isInternalIp = inputHostIps.some((el) => isPrivateIp(el)); const isInternalIp = inputHostIps.some((el) => isPrivateIp(el));
if (isInternalIp) throw new BadRequestError({ message: "Local IPs not allowed as URL" }); if (isInternalIp && !appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)
throw new BadRequestError({ message: "Local IPs not allowed as URL" });
}; };
type FQDNOptions = { type FQDNOptions = {

4
docs/integrations/app-connections/mssql.mdx
View File

@@ -51,6 +51,10 @@ Infisical supports connecting to Microsoft SQL Server using database principals.
- `username` - The username of the login created in the steps above - `username` - The username of the login created in the steps above
- `password` - The password of the login created in the steps above - `password` - The password of the login created in the steps above
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured) - `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
<Note>
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
</Note>
</Step> </Step>
</Steps> </Steps>

4
docs/integrations/app-connections/postgres.mdx
View File

@@ -41,6 +41,10 @@ Infisical supports connecting to PostgreSQL using a database role.
- `username` - The role name of the login created in the steps above - `username` - The role name of the login created in the steps above
- `password` - The role password of the login created in the steps above - `password` - The role password of the login created in the steps above
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured) - `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
<Note>
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
</Note>
</Step> </Step>
</Steps> </Steps>

4
docs/self-hosting/configuration/envars.mdx
View File

@@ -34,6 +34,10 @@ Used to configure platform-specific security and operational settings
this to `false`. this to `false`.
</ParamField> </ParamField>
<ParamField query="ALLOW_INTERNAL_IP_CONNECTIONS" type="bool" default="false" optional>
Determines whether App Connections and Dynamic Secrets are permitted to connect with internal/private IP addresses.
</ParamField>
## CORS ## CORS
Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain. Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain.