Ssrf in Flask

Remediating SSRF in Flask requires a defense-in-depth approach. The most effective strategy combines input validation, network controls, and safe request handling.

URL validation and allowlisting is the first line of defense:

from flask import Flask, request, jsonify
from urllib.parse import urlparse
import re

app = Flask(__name__)

# Allowlist of permitted domains
ALLOWED_DOMAINS = {'api.example.com', 'webhook.partner.com'}

def is_allowed_url(url):
    try:
        parsed = urlparse(url)
        if not parsed.scheme or parsed.scheme not in ['http', 'https']:
            return False
        if parsed.netloc in ALLOWED_DOMAINS:
            return True
        # Block private networks
        if re.match(r'^(10|172/(1[6-9]|2[0-9]|3[0-1])|192\.168)\.', parsed.netloc):
            return False
        return False  # Default deny
    except Exception:
        return False

@app.route('/safe-fetch', methods=['POST'])
def safe_fetch():
    url = request.json.get('url')
    if not is_allowed_url(url):
        return jsonify({'error': 'URL not allowed'}), 400
    response = requests.get(url, timeout=10)
    return jsonify({'content': response.text})

For Flask applications that must access external services, use network-level controls:

# Configure requests to use a proxy that blocks internal networks
import os
os.environ['HTTP_PROXY'] = 'http://proxy.example.com:8080'
os.environ['HTTPS_PROXY'] = 'http://proxy.example.com:8080'

Flask-specific SSRF mitigation with timeout and size limits:

from flask import Flask, request, jsonify
import requests

app = Flask(__name__)

@app.route('/fetch-with-limits', methods=['POST'])
def fetch_with_limits():
    url = request.json.get('url')
    
    # Basic validation
    if not url or not url.startswith(('http://', 'https://')):
        return jsonify({'error': 'Invalid URL'}), 400

    try:
        # Set strict timeout and size limits
        response = requests.get(url, timeout=(3.0, 10.0), stream=True)  # 3s connect, 10s read
        
        # Limit response size to prevent SSRF via large responses
        content = b''
        for chunk in response.iter_content(1024):
            content += chunk
            if len(content) > 1024 * 1024:  # 1MB limit
                return jsonify({'error': 'Response too large'}), 413
        
        return jsonify({'content': content.decode('utf-8', errors='ignore')})
        
    except requests.exceptions.Timeout:
        return jsonify({'error': 'Request timeout'}), 504
    except requests.exceptions.RequestException:
        return jsonify({'error': 'Request failed'}), 502

Integrate middleBrick into your Flask development workflow to catch SSRF issues early:

# In your Flask application's test suite
def test_ssrf_protection():
    # Test with malicious URLs
    test_urls = [
        'http://localhost:8080',
        'http://169.254.169.254/latest/meta-data/',
        'http://192.168.1.1',
        'file:///etc/passwd',
        'gopher://localhost:80',
    ]
    
    for url in test_urls:
        response = client.post('/safe-fetch', json={'url': url})
        assert response.status_code == 400  # Should be blocked

For production Flask applications, combine these code-level protections with network ACLs to block outbound connections to internal networks, ensuring that even if the application logic is bypassed, the network infrastructure provides a final defense layer.