{"action":"closed","issue":{"url":"https://api.github.com/repos/dakrone/clj-http/issues/437","repository_url":"https://api.github.com/repos/dakrone/clj-http","labels_url":"https://api.github.com/repos/dakrone/clj-http/issues/437/labels{/name}","comments_url":"https://api.github.com/repos/dakrone/clj-http/issues/437/comments","events_url":"https://api.github.com/repos/dakrone/clj-http/issues/437/events","html_url":"https://github.com/dakrone/clj-http/issues/437","id":300939646,"number":437,"title":"DNS rebinding attacks","user":{"login":"tirkarthi","id":3972343,"avatar_url":"https://avatars3.githubusercontent.com/u/3972343?v=4","gravatar_id":"","url":"https://api.github.com/users/tirkarthi","html_url":"https://github.com/tirkarthi","followers_url":"https://api.github.com/users/tirkarthi/followers","following_url":"https://api.github.com/users/tirkarthi/following{/other_user}","gists_url":"https://api.github.com/users/tirkarthi/gists{/gist_id}","starred_url":"https://api.github.com/users/tirkarthi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tirkarthi/subscriptions","organizations_url":"https://api.github.com/users/tirkarthi/orgs","repos_url":"https://api.github.com/users/tirkarthi/repos","events_url":"https://api.github.com/users/tirkarthi/events{/privacy}","received_events_url":"https://api.github.com/users/tirkarthi/received_events","type":"User","site_admin":false},"labels":[{"id":763956828,"url":"https://api.github.com/repos/dakrone/clj-http/labels/waiting%20for%20user","name":"waiting for user","color":"e99695","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-02-28T08:55:51Z","updated_at":"2018-03-09T04:13:31Z","closed_at":"2018-03-09T04:13:31Z","author_association":"NONE","body":"Is this library susceptible to [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks? \r\n\r\nI wrote a [middleware](https://github.com/tirkarthi/clj-http-ssrf/) for the library to prevent [SSRF](https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/) and there was an [issue](https://github.com/tirkarthi/clj-http-ssrf/issues/1) reported regarding DNS rebinding. Since this library mostly uses HTTP components I wanted to check back on the same since there is some caching involved in DNS lookups as reported in the linked issue.\r\n\r\nFeel free to close if this is irrelevant."}}
{"actor":{"display_login":"dakrone"}}