From c539c0f174030799249cd501411fafcaf90cd2b3 Mon Sep 17 00:00:00 2001
From: David Roetzel <david@roetzel.de>
Date: Thu, 30 Jul 2026 12:48:37 +0200
Subject: [PATCH] Enable httpx's SSRF protection

---
 fasp_base/lib/fasp_base/request.rb           |  2 ++
 fasp_base/test/lib/fasp_base/request_test.rb | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 fasp_base/test/lib/fasp_base/request_test.rb

diff --git a/fasp_base/lib/fasp_base/request.rb b/fasp_base/lib/fasp_base/request.rb
index 18628dd..1e8cbff 100644
--- a/fasp_base/lib/fasp_base/request.rb
+++ b/fasp_base/lib/fasp_base/request.rb
@@ -1,4 +1,6 @@
 class FaspBase::Request
+  HTTPX = ::HTTPX.plugin(:ssrf_filter)
+
   def initialize(server)
     @server = server
   end
diff --git a/fasp_base/test/lib/fasp_base/request_test.rb b/fasp_base/test/lib/fasp_base/request_test.rb
new file mode 100644
index 0000000..1441a0c
--- /dev/null
+++ b/fasp_base/test/lib/fasp_base/request_test.rb
@@ -0,0 +1,18 @@
+require "test_helper"
+
+module FaspBase
+  class FaspBase::RequestTest < ActiveSupport::TestCase
+    test "prevents request to local IP" do
+      server = Server.create!(
+        user: fasp_base_users(:mastodon_admin),
+        base_url: "https://198.51.100.23/api/fasp",
+        fasp_remote_id: "somefasp1962"
+      )
+      request = Request.new(server)
+
+      assert_raises HTTPX::ServerSideRequestForgeryError do
+        request.get("/")
+      end
+    end
+  end
+end