This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit bbd1d71504af1060fb410905f4ca754f9a4b3ee5 Author: Dave Brondsema <[email protected]> AuthorDate: Tue May 5 11:54:36 2026 -0400 [#8603] urlopen_allow_internal_hostnames setting should work for webhook and importer forms --- Allura/allura/lib/validators.py | 8 ++++++++ Allura/allura/tests/test_webhooks.py | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/Allura/allura/lib/validators.py b/Allura/allura/lib/validators.py index 1b57a9981..e2ceffbba 100644 --- a/Allura/allura/lib/validators.py +++ b/Allura/allura/lib/validators.py @@ -17,10 +17,14 @@ import json import re + +import tg from bson import ObjectId import formencode as fe from formencode import validators as fev from tg import tmpl_context as c +from tg.support.converters import asbool + from . import helpers as h from datetime import datetime from urllib.parse import urlsplit @@ -51,6 +55,10 @@ class NonPrivateUrl(URL): # prevents private IPs def _convert_to_python(self, value, state): value = super()._convert_to_python(value, state) + + if asbool(tg.config.get('urlopen_allow_internal_hostnames', 'false')): + return value + url_components = urlsplit(value) try: host_ip = socket.gethostbyname(url_components.hostname) diff --git a/Allura/allura/tests/test_webhooks.py b/Allura/allura/tests/test_webhooks.py index 922f41a88..87213094b 100644 --- a/Allura/allura/tests/test_webhooks.py +++ b/Allura/allura/tests/test_webhooks.py @@ -302,6 +302,11 @@ def test_create_ssrf_private_url_rejected(self, url): r = self.app.post(self.url + '/repo-push/create', {'url': url, 'secret': ''}) self.find_error(r, 'url', 'Invalid URL') + @patch.dict(config, {'urlopen_allow_internal_hostnames': 'true'}) + def test_create_private_url_allowed(self): + with td.audits(r'add webhook repo-push'): + self.app.post(self.url + '/repo-push/create', {'url': 'http://localhost/hook', 'secret': ''}) + @pytest.mark.parametrize('url', [ 'http://localhost/hook', 'http://127.0.0.1/hook',
