feat: add SSRF protection for mod downloads

Cargo.toml

@@ -50,6 +50,7 @@ tracing-subscriber = { version = "0.3", features = [
   "fmt",
   "json",
 ] }
+url = "2.5.8"
 urlencoding = "2.1.3"
 utoipa = { version = "5.4.0", features = ["actix_extras", "chrono", "uuid"] }
 utoipa-swagger-ui = { version = "9.0.2", features = ["actix-web"] }

src/config.rs

@@ -8,6 +8,7 @@ use tokio::sync::mpsc::Sender;
 
 use crate::{
     endpoints::mods::IndexQueryParams,
+    pin_dns::PinDnsResolver,
     s3_worker::S3WorkerTask,
     storage::{LocalBackend, PrivateDisk, PublicDisk, S3Backend, S3Configuration},
     types::{
@@ -35,6 +36,7 @@ pub struct AppData {
 
     mods_cache: Cache<IndexQueryParams, ApiResponse<PaginatedData<Mod>>>,
     http_client: reqwest::Client,
+    pin_dns_http_client: reqwest::Client,
 
     s3_sender: OnceLock<Sender<S3WorkerTask>>,
 }
@@ -84,6 +86,13 @@ pub async fn build_config() -> anyhow::Result<AppData> {
         None
     };
 
+    let pin_dns_http_client = reqwest::Client::builder()
+        .dns_resolver(Arc::new(PinDnsResolver))
+        .pool_max_idle_per_host(4)
+        .connect_timeout(Duration::from_secs(10))
+        .read_timeout(Duration::from_secs(30))
+        .build()?;
+
     Ok(AppData {
         db: pool,
         app_url: app_url.clone(),
@@ -114,6 +123,7 @@ pub async fn build_config() -> anyhow::Result<AppData> {
             .connect_timeout(Duration::from_secs(10))
             .read_timeout(Duration::from_secs(30))
             .build()?,
+        pin_dns_http_client,
         s3_sender: OnceLock::new(),
     })
 }
@@ -193,6 +203,21 @@ impl AppData {
         &self.http_client
     }
 
+    /// Client that allows pinning DNS queries to a certain ip address.
+    /// Useful for preventing Server Side Request Forgery.
+    ///
+    /// To pin an address, you have to use pin_dns::PINNED_ADDR.
+    ///
+    /// Basically, if you have a URL as user input, *always* use this client.
+    ///
+    /// The downside is that you get worse DNS performance, doesn't matter when
+    /// security is involved though.
+    ///
+    /// For an example, check mod_zip::download()
+    pub fn pin_dns_http_client(&self) -> &reqwest::Client {
+        &self.pin_dns_http_client
+    }
+
     pub fn init_s3_sender(&self, sender: Sender<S3WorkerTask>) {
         self.s3_sender
             .set(sender)

src/endpoints/mod_versions.rs

@@ -353,7 +353,12 @@ pub async fn create_version(
         .filter(|c| c.is_ascii() && *c != '\0')
         .collect();
 
-    let bytes = download_mod(data.http_client(), &download_link, data.max_download_mb()).await?;
+    let bytes = download_mod(
+        data.pin_dns_http_client(),
+        &download_link,
+        data.max_download_mb(),
+    )
+    .await?;
     let json = ModJson::from_zip(&bytes, &download_link, make_accepted)
         .inspect_err(|e| tracing::error!("Failed to parse mod.json: {e}"))?;
     if json.id != the_mod.id {
@@ -575,7 +580,7 @@ pub async fn update_version(
         }
 
         let bytes = mod_zip::download_mod_hash_comp(
-            data.http_client(),
+            data.pin_dns_http_client(),
             &version.download_link,
             &version.hash,
             data.max_download_mb(),

src/endpoints/mods.rs

@@ -218,7 +218,7 @@ pub async fn create(
     let dev = auth.developer()?;
     let mut pool = data.db().acquire().await?;
     let bytes = mod_zip::download_mod(
-        data.http_client(),
+        data.pin_dns_http_client(),
         &payload.download_link,
         data.max_download_mb(),
     )

src/main.rs

@@ -20,6 +20,7 @@ mod jobs;
 mod logging;
 mod mod_zip;
 mod openapi;
+mod pin_dns;
 mod s3_worker;
 mod storage;
 mod types;