Fix SSRF in C# and ASP.NET Core

// No validation at all: parse the URL and hand the host to the resolver.
private static Transport.UrlParts Target(string rawUrl) => Transport.Parse(rawUrl);

private static readonly HashSet<string> AllowedSchemes = new(StringComparer.Ordinal) { "http", "https" };
private static readonly HashSet<int> AllowedPorts = [80, 443];

// Private, loopback, link-local and other non-public ranges in one table.
private static readonly (byte[] Prefix, int Len)[] DenyV4 = ParseCidrs(
    "0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
    "172.16.0.0/12", "192.0.0.0/24", "192.0.2.0/24", "192.88.99.0/24", "192.168.0.0/16",
    "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4");

private sealed record Target(string Scheme, string Ip, int Port, string HostHeader, string Path, string Origin);

// inet_aton-style parse so decimal (2130706433), octal (0177.0.0.1) and hex
// (0x7f.0.0.1) literals are recognised as addresses rather than trusted as names.
private static byte[]? ParseIpLiteral(string host)
{
    var inner = host.StartsWith('[') && host.EndsWith(']') ? host[1..^1] : host;
    if (inner.Contains(':'))
    {
        return IPAddress.TryParse(inner, out var v6) && v6.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6
            ? v6.GetAddressBytes()
            : null;
    }
    if (inner != host)
    {
        return null; // bracketed but not IPv6
    }
    var parts = host.Split('.');
    if (parts.Length is < 1 or > 4)
    {
        return null;
    }
    var nums = new long[parts.Length];
    for (var i = 0; i < parts.Length; i++)
    {
        var p = parts[i];
        try
        {
            if (Regex.IsMatch(p, "^0[xX][0-9a-fA-F]+$"))
            {
                nums[i] = Convert.ToInt64(p[2..], 16);
            }
            else if (Regex.IsMatch(p, "^0[0-7]*$"))
            {
                nums[i] = p == "0" ? 0 : Convert.ToInt64(p, 8);
            }
            else if (Regex.IsMatch(p, "^[1-9][0-9]*$"))
            {
                nums[i] = long.Parse(p, CultureInfo.InvariantCulture);
            }
            else
            {
                return null;
            }
        }
        catch (FormatException)
        {
            return null;
        }
        catch (OverflowException)
        {
            return null;
        }
    }
    long[] caps = [0xFFFFFFFF, 0xFFFFFF, 0xFFFF, 0xFF];
    var last = nums.Length - 1;
    if (nums[last] > caps[last])
    {
        return null;
    }
    for (var i = 0; i < last; i++)
    {
        if (nums[i] > 0xFF)
        {
            return null;
        }
    }
    var value = nums.Length switch
    {
        1 => nums[0],
        2 => (nums[0] << 24) | nums[1],
        3 => (nums[0] << 24) | (nums[1] << 16) | nums[2],
        _ => (nums[0] << 24) | (nums[1] << 16) | (nums[2] << 8) | nums[3],
    };
    return [(byte)(value >> 24), (byte)(value >> 16), (byte)(value >> 8), (byte)value];
}

private static bool InRange(byte[] addr, byte[] prefix, int prefixLen)
{
    for (var bit = 0; bit < prefixLen; bit++)
    {
        var idx = bit >> 3;
        var mask = 1 << (7 - (bit & 7));
        if ((addr[idx] & mask) != (prefix[idx] & mask))
        {
            return false;
        }
    }
    return true;
}

// Reject anything that is not a public address, unwrapping IPv4-mapped IPv6, NAT64
// and 6to4 to the IPv4 they actually carry.
private static void AssertPublic(byte[] original)
{
    var addr = original;
    if (addr.Length == 16)
    {
        if (InRange(addr, Bytes("::ffff:0:0"), 96) || InRange(addr, Bytes("64:ff9b::"), 96))
        {
            addr = addr[12..];
        }
        else if (InRange(addr, Bytes("2002::"), 16))
        {
            addr = addr[2..6];
        }
        else
        {
            var globalUnicast = InRange(addr, Bytes("2000::"), 3) && !InRange(addr, Bytes("2001:db8::"), 32);
            if (!globalUnicast)
            {
                throw new BlockedRequestException("non-public IPv6 address");
            }
            return;
        }
    }
    foreach (var (prefix, len) in DenyV4)
    {
        if (InRange(addr, prefix, len))
        {
            throw new BlockedRequestException("non-public IPv4 address");
        }
    }
}

// Parse the URL, enforce the scheme and port allowlists, turn the host into a vetted
// address, and reject (not resolve) IP literals that are not public.
private Target Vet(string rawUrl)
{
    if (!Uri.TryCreate(rawUrl, UriKind.Absolute, out var uri))
    {
        throw new BlockedRequestException("invalid URL");
    }
    if (!AllowedSchemes.Contains(uri.Scheme))
    {
        throw new BlockedRequestException("scheme not allowed");
    }
    if (!string.IsNullOrEmpty(uri.UserInfo))
    {
        throw new BlockedRequestException("credentials in URL not allowed");
    }
    if (!AllowedPorts.Contains(uri.Port))
    {
        throw new BlockedRequestException("port not allowed");
    }

    var literal = ParseIpLiteral(uri.Host);
    string[] addresses;
    if (literal is not null)
    {
        AssertPublic(literal);
        addresses = [new IPAddress(literal).ToString()];
    }
    else
    {
        addresses = [.. _network.Resolve(uri.Host)];
        if (addresses.Length == 0)
        {
            throw new BlockedRequestException("host did not resolve");
        }
        foreach (var ip in addresses)
        {
            AssertPublic(IPAddress.Parse(ip.StartsWith('[') ? ip[1..^1] : ip).GetAddressBytes());
        }
    }
    return new Target(uri.Scheme, addresses[0], uri.Port, uri.Authority, uri.PathAndQuery,
        uri.GetLeftPart(UriPartial.Authority));
}

private static byte[] Bytes(string ip) => IPAddress.Parse(ip).GetAddressBytes();

private static (byte[], int)[] ParseCidrs(params string[] cidrs)
{
    var list = new List<(byte[], int)>();
    foreach (var cidr in cidrs)
    {
        var parts = cidr.Split('/');
        list.Add((IPAddress.Parse(parts[0]).GetAddressBytes(), int.Parse(parts[1], CultureInfo.InvariantCulture)));
    }
    return [.. list];
}

// A 3xx response is a fresh destination decision, not permission to follow. Re-run
// the full policy on every hop and pin each connection to its own vetted address.
public async Task<FetchResult> FetchAsync(string url, CancellationToken cancellationToken)
{
    var target = url;
    for (var hop = 0; hop <= Transport.MaxRedirects; hop++)
    {
        var t = Vet(target);
        var response = await Transport.SendOnceAsync(
            _client, t.Scheme, t.Ip, t.Port, t.HostHeader, t.Path, Transport.MaxResponseBytes, cancellationToken);
        if (response.Status is >= 300 and < 400 && response.Location is not null)
        {
            target = new Uri(new Uri(target), response.Location).ToString(); // relative to this hop's URL; validated again
            continue;
        }
        return Transport.Summarise(response);
    }
    throw new BlockedRequestException("too many redirects");
}

// A substring blocklist of "obviously internal" hosts. Looks reassuring; the address
// an attacker actually reaches is decided by DNS, which this never consults.
private static readonly string[] BlockedSubstrings =
    ["localhost", "127.0.0.1", "0.0.0.0", "169.254", "10.", "192.168", "172.16", "::1", "metadata", "internal"];

private static void Screen(string host)
{
    var lower = host.ToLowerInvariant();
    foreach (var bad in BlockedSubstrings)
    {
        if (lower.Contains(bad))
        {
            throw new BlockedRequestException("host is blocked");
        }
    }
}

private static Transport.UrlParts Target(string rawUrl) => Transport.Parse(rawUrl);