fix: properly handle urls in saferoundtripper (#267)

* debug logging

* tdd: added test case for failure behavior

* now attempting to resolve url

Author: cbosss

http/http.go

@@ -29,17 +29,19 @@ func init() {
 	}
 }
 
-func blocksContain(blocks []*net.IPNet, ip net.IP) bool {
+func blocksContainsAny(blocks []*net.IPNet, ips []net.IP) bool {
 	for _, block := range blocks {
-		if block.Contains(ip) {
-			return true
+		for _, ip := range ips {
+			if block.Contains(ip) {
+				return true
+			}
 		}
 	}
 	return false
 }
 
-func isPrivateIP(ip net.IP) bool {
-	return blocksContain(privateIPBlocks, ip)
+func containsPrivateIP(ips []net.IP) bool {
+	return blocksContainsAny(privateIPBlocks, ips)
 }
 
 type noLocalTransport struct {
@@ -59,18 +61,19 @@ func (no noLocalTransport) RoundTrip(req *http.Request) (*http.Response, error)
 				no.errlog.WithError(err).Error("Cancelled request due to error in address parsing")
 				return
 			}
-			ip := net.ParseIP(host)
-			if ip == nil {
+
+			ips, err := net.LookupIP(host)
+			if err != nil || len(ips) == 0 {
 				cancel()
-				no.errlog.WithError(err).Error("Cancelled request due to error in ip parsing")
+				no.errlog.WithError(err).Error("Cancelled request due to error in host lookup")
 				return
 			}
 
-			if blocksContain(no.allowedBlocks, ip) {
+			if blocksContainsAny(no.allowedBlocks, ips) {
 				return
 			}
 
-			if isPrivateIP(ip) {
+			if containsPrivateIP(ips) {
 				cancel()
 				no.errlog.Error("Cancelled attempted request to ip in private range")
 				return

http/http_test.go

@@ -27,7 +27,10 @@ func TestIsPrivateIP(t *testing.T) {
 
 	for _, tt := range tests {
 		ip := net.ParseIP(tt.ip)
-		assert.Equal(t, tt.expected, isPrivateIP(ip))
+		if ip == nil {
+			require.Fail(t, "failed to parse IP")
+		}
+		assert.Equal(t, tt.expected, containsPrivateIP([]net.IP{ip}))
 	}
 }
 
@@ -43,6 +46,10 @@ func TestSafeHTTPClient(t *testing.T) {
 
 	client := SafeHTTPClient(&http.Client{}, logrus.New())
 
+	// It allows accessing non-local addresses
+	_, err = client.Get("https://google.com")
+	require.Nil(t, err)
+
 	// It blocks the local IP.
 	_, err = client.Get(ts.URL)
 	require.NotNil(t, err)