Domain resolution issue affecting topic embeds

Bug
1

There is possibly a domain resolution issue affecting topic embeds.

  1. The topic embed system relies on FinalDestination to resolve topic embed urls (see here).

  2. FinalDestination resolves the hostname of a url to an IP via SSRFDetector (see here)

  3. FinalDestination then sends the uri to Excon for the actual request (see here).

This means that some topic embed urls, for example

"https://opensource.org/blog/osi-response-to-ntia"

end up being sent to Excon for a GET request like so:

"https://[2604:a880:800:a1::2f0:a001]/blog/osi-response-to-ntia"

This request will time out. An Excon.get of the original URL will not.

2

It seems ok here on Meta:

From your description, my guess would be that your server is resolving ipv6 records when making DNS lookups (we use getaddrinfo for that). But then when attempting to connect to them, it’s failing.

That might be because it tries the ip6 address, fails, and then falls back to the ip4 address. We don’t currently have that kind of fallback logic in FinalDestination#resolve:

2 Likes