Fix conditions to skip IP lookups in URL validation

Pham Sy Minhrequested to merge
shelld3v/gitlab:patch-266 into master

What does this MR do and why?

Gitlab skips IP lookups when validate URLs if:

  • Requests to localhost are allowed
  • Requests to local network are allowed
  • Block all requests, except for IP addresses, IP ranges, and domain names defined in the allowlist option is not enabled
  • DNS-rebinding attack protection is disabled

However, the last condition is unnecessary, because DNS-rebinding protection is created to purely just prevent users from using DNS-rebinding technique to bypass any of the 3 options above. So if there is no restriction against any host, the DNS-rebinding protection is no longer needed as well.

Edited by Pham Sy Minh

Merge request reports