Patch for CVE-2022-0870

https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/
gogs · unknwon · Mar 8, 2022 · Mar 6, 2022 · Mar 6, 2022 · Mar 7, 2022
commit 689ed339112720c62707a5d5238ff797fd4e5bde
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"net"
 	"strings"
 
 	"github.com/gogs/git-module"
@@ -119,17 +120,42 @@ func WebhooksNew(c *context.Context, orCtx *orgRepoContext) {
 }
 
 var localHostnames = []string{
-	"localhost",
-	"127.0.0.1",
-	"::1",
-	"0:0:0:0:0:0:0:1",
+// https://datatracker.ietf.org/doc/html/rfc5735:
+	"127.0.0.0/8", // Loopback
+	"0.0.0.0/8", // "This" network
+	"100.64.0.0/10", // Shared address space
+	"169.254.0.0/16", // Link local
+	"172.16.0.0/12", // Private-use networks
+	"192.0.0.0/24", // IETF Protocol assignments
+	"192.0.2.0/24", // TEST-NET-1
+	"192.88.99.0/24", // 6to4 Relay anycast
+	"192.168.0.0/16", // Private-use networks
+	"198.18.0.0/15", // Network interconnect
+	"198.51.100.0/24", // TEST-NET-2
+	"203.0.113.0/24", // TEST-NET-3
+	"255.255.255.255/32", // Limited broadcast
+
+// https://datatracker.ietf.org/doc/html/rfc1918:
+	"10.0.0.0/8", // Private-use networks
+
+// https://datatracker.ietf.org/doc/html/rfc6890:
+	"::1/128", // Loopback
+	"FC00::/7", // Unique local address
+	"FE80::/10", // Multicast address
 }
 
 // isLocalHostname returns true if given hostname is a known local address.
 func isLocalHostname(hostname string) bool {
-	for _, local := range localHostnames {
-		if hostname == local {
-			return true
+	resolvedAddress, dnsError := net.LookupIP(host)
+	if dnsError != nil {
+		return true
+	}
+	for _, iterativeAddress := range resolvedAddress {
+		for _, localRangeStr := range localHostnames {
+		    _, localRange, _ := net.ParseCIDR(localRangeStr)
+		    if localRange.Contains(iterativeAddress) {
+		        return true
+		    }
 		}
 	}
 	return false