History

Shrikant Sharat Kandula 5a1ec0c591 chore: Disallow plugin requests to localhost (#34250 ) The microservices that run inside the Appsmith container, trust each other, and may expose sensitive API endpoints to other internal microservices. These sensitive APIs aren't accessible by outside the Appsmith container, protected by Caddy's routing. This means that the backend server's ability to make user-configured HTTP requests, can lead to SSRFs to such sensitive API calls, if it's allowed to call APIs on localhost. In other words, Caddy establishes a trust boundary that protects these internal APIs from outside the container. But we lack such a trust boundary for the backend's plugins (API plugin, Elasticsearch plugin, etc.). This PR solves that. In this PR, we block both IPv4 and IPv6 loopback addresses. No additional changes needed on EE, no conflicts, and all unit and Cypress tests pass. /test all <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/9590358198> > Commit: 5445c70aa873942c3edae9fbfcc57a6d2554b815 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=9590358198&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `` <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - New Features - Improved handling of disallowed hosts by dynamically computing based on environment variables, offering more flexibility and control. - Refactor - Enhanced the `makeWebClient()` method to use a more efficient approach for creating WebClient objects with custom configurations. - Chores - Added an `ENV` declaration for `IN_DOCKER` in the Dockerfile to better manage Docker-specific configurations. <!-- end of auto-generated comment: release notes by coderabbit.ai -->		2024-06-20 11:00:22 +05:30
..
.run	feat: Databricks plugin (#29746 )	2023-12-26 10:04:09 +05:30
appsmith-git	chore: autocommit feature branch (#34062 )	2024-06-10 12:35:23 +05:30
appsmith-interfaces	chore: Disallow plugin requests to localhost (#34250 )	2024-06-20 11:00:22 +05:30
appsmith-plugins	chore: Add gpt-4o mode in vision command (#33637 )	2024-06-17 14:07:03 +05:30
appsmith-server	chore: Disallow plugin requests to localhost (#34250 )	2024-06-20 11:00:22 +05:30
envs	test: Enable server tests for the PRs with base PG branch (#33429 )	2024-05-22 15:55:20 +05:30
mongo-seed
reactive-caching	chore: Introduce changes to minimize git footprint (#32595 )	2024-04-16 21:34:24 +05:30
scripts	chore: Splitting JS Object body dump vs parsed JS Object update to remove race condition originated bad state (#33124 )	2024-05-13 09:38:30 +05:30
.gitignore	chore: Removed failed tests file from git (#29602 )	2023-12-14 13:02:36 +05:30
build.sh	test: Enable server tests for the PRs with base PG branch (#33429 )	2024-05-22 15:55:20 +05:30
buildpack-run.sh
pom.xml	chore: Introduce changes to minimize git footprint (#32595 )	2024-04-16 21:34:24 +05:30
Procfile
README.md
system.properties

README.md

Appsmith Server

This is the server-side repository for the Appsmith framework.

For details on setting up your development machine, please refer to this Setup Guide.