AntiSSRFPolicy.add_denied_addresses Method

Definition

This method will alter the existing AntiSSRFPolicy instance by adding a list of IPv4/IPv6 addresses or subnets that the caller will not be allowed to access.

The external-only configurations add all internal and special-purpose addresses to the policy. The internal-only configuration sets deny_all_unspecified_ips to True. The blank configuration does not add any denied addresses.

allowed_addresses takes precedence over denied_addresses. If an IP address matches both, it will be considered allowed by the policy.

deny_all_unspecified_ips takes precedence over denied_addresses. If deny_all_unspecified_ips is True, denied_addresses will not be considered when determining if an IP address is allowed or blocked by the policy.

def add_denied_addresses(networks: list[str]) -> None

Parameters

networks: list[str]

The list of IPv4 or IPv6 IP addresses or subnets in CIDR notation that the caller will be allowed to access.

Networks can be:

• IPv4 addresses in dotted-quad notation
  • ex. 127.0.0.1
• IPv6 addresses in expanded notation x:x:x:x:x:x:x:x, where the xs are one to four hexadecimal digits
  • ex. ABCD:EF01:2345:6789:ABCD:EF01:2345:6789
• IPv6 addresses in compressed notation, where one group of consecutive 0s is represented with ::
  • ex. ABCD::, ::1, ABCD:EF01::2345:6789
• IPv6 in mixed notation x:x:x:x:x:x:d.d.d.d, where the xs are hexadecimal values and the ds are decimal
  • ex. ::FFFF:127.0.0.1
• Any of the above addresses with a decimal prefix length <ip-address>/<prefix-length>
  • ex. 192.0.2.0/24, 2001:db8::/32

Errors

ValueError

• The networks argument is None or empty.

AntiSSRFError

• Some network in networks is improperly formatted.
• OR deny_all_unspecified_ips is True.
• OR editing after a session has been retrieved.

Examples

If one would like to deny addresses in the network 10.0.0.0/24 in addition to all internal and special-use IP addresses, they could do the following:

from AntiSSRF import AntiSSRFPolicy, AntiSSRFError, PolicyConfigOptions

# With external configurations, all sensitive IP addresses are blocked by the AntiSSRFPolicy.
policy = AntiSSRFPolicy(PolicyConfigOptions.EXTERNAL_ONLY_LATEST)

# Add additional denied addresses to deny 10.0.0.0/24.
policy.add_denied_addresses(["10.0.0.0/24"])

# Create a session that applies the policy to every request
session = policy.get_antissrf_session()

# These requests are allowed: external addresses outside the denied ranges.
for allowed_url in ["https://bing.com", "https://12.34.56.78", "https://17.2.85.6"]:
    response = session.get(allowed_url)

# These requests are blocked: the newly denied 10.0.0.0/24 plus internal and special-use ranges.
for blocked_url in ["https://10.255.0.0", "https://127.0.0.3", "https://127.25.0.13", "https://192.32.6.17"]:
    try:
        response = session.get(blocked_url)
        # Not reached - the address is blocked by the policy
    except AntiSSRFError:
        # Reached - the address is blocked by the policy
        pass