Configurable endpoint for S3 Adaptor

[bblaszkow06]

No description provided.

[depthfirst-app]

🟠 Severity: HIGH

The resolved IP from SSRF.safe_resolve/1 is discarded ({:ok, _} -> []). The original hostname is stored and later passed directly to the FSS S3 client, which re-resolves DNS at request time. For HTTP endpoints, this enables DNS rebinding: an attacker registers a domain that resolves to a public IP at validation, then switches the DNS record to a private address (e.g. 169.254.169.254) before requests are made — bypassing the SSRF check entirely.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: The DNS rebinding bypass exists because no_ssrf_validator/2 discards the resolved IP address ({:ok, _} -> []) and the original hostname is stored in the changeset, which fss_s3_config/1 later passes directly to the FSS S3 client — allowing DNS re-resolution at request time.

The fix requires two coordinated changes in the same file:

1. Replace line 72 in validate_config/1, changing:

|> Changeset.validate_change(:endpoint, &no_ssrf_validator/2)

to:

|> pin_endpoint_against_ssrf()

2. Replace the entire no_ssrf_validator/2 function (lines 75-82) with a new function that both validates AND rewrites the endpoint to pin the resolved IP:

defp pin_endpoint_against_ssrf(%Changeset{} = changeset) do
  case Changeset.fetch_change(changeset, :endpoint) do
    {:ok, endpoint} ->
      host = URI.parse(endpoint).host

      case SSRF.safe_resolve(host) do
        {:ok, ip} ->
          uri = URI.parse(endpoint)
          ip_host = SSRF.url_host(ip)
          pinned = URI.to_string(%{uri | host: ip_host, authority: nil})
          Changeset.put_change(changeset, :endpoint, pinned)

        {:error, reason} ->
          Changeset.add_error(changeset, :endpoint, reason, validation: :ssrf)
      end

    :error ->
      changeset
  end
end

By rewriting the endpoint in the changeset to use the resolved IP address at validation time (mirroring the approach in SSRFProtection middleware for HTTP adaptor), fss_s3_config/1 will receive the IP-pinned endpoint and the FSS S3 client will connect directly to it — eliminating the DNS re-resolution window exploited by DNS rebinding. SSRF.url_host/1 is already available in the module via the SSRF alias and handles IPv6 bracket formatting correctly.