Fetches refuse internal addresses unless fetch_internal lists them (#320)

ipx's clients had no destination policy and followed redirects
anywhere. Adding a feed returned the status or first line of whatever
answered at the address; an enclosure declared as audio was downloaded
whole from any URL and served back through /media; /api/art fetched
any image a feed named. Feeds come from publishers and anyone signed
in, so loopback, the Docker network and the LAN were all reachable.

ipx-feed's guard is a connector layer: after the name resolves and the
connection opens, before the request is written, it looks at the
peer's address and refuses anything off the public internet unless
config.toml's [general] fetch_internal lists it. Being on the
connection, it covers every request on ctx.client and feed_client,
each redirect hop, IP literals (which never reach a DNS resolver) and
a name that resolves differently the second time. reqwest's rustls
connection reports the peer address; a test run by hand checks HTTPS
gets through, since were it lost every https fetch would be refused.

The directory is on the server's own network by design
(http://ipx-directory:8100), so it moves to local_client, unguarded,
set by an admin. The browser suite and load tests serve their feeds on
loopback and list 127.0.0.1.

Not covered: librqbit's own connections (trackers, peers), which do
not go through these clients.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ipx/CHANGELOG.md

@@ -26,6 +26,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - A downloaded file opens in the browser only when it is audio, video, an image other than SVG, a PDF or plain text, and is saved otherwise. An SVG or web page a podcast sent ran its script as iPX, signed in as whoever opened it (#319).
 - An OPML nested more than 100 levels deep is refused, uploaded or fetched. A deep enough one stopped iPX, and a subscribed one stopped it again each time it restarted (#322).
 - A `.torrent` file larger than 10 MB, or slower than the torrent stall limit, is refused. iPX read one into memory however large it was (#330).
+- Feeds, episodes, artwork and `.torrent` files are no longer fetched from internal addresses (loopback, the LAN, Docker's networks), redirects included, unless config.toml's `fetch_internal` lists them. Adding a feed could read what a service inside the network answered (#320).
 
 ## [1.4.0] - 2026-10-19
 

crates/ipx/src/config.rs

@@ -56,6 +56,10 @@ pub struct General {
     /// How far back a new Signal looks, in days (#276): each item is a call to TypeSafe, and a
     /// month of production's feeds was about 8,000.
     pub signal_days: u64,
+    /// Internal addresses and networks feeds, episodes and artwork may still be fetched from, as
+    /// `["192.168.1.20", "10.0.0.0/8"]`: everything off the public internet is refused otherwise,
+    /// since a feed or anyone signed in names what is fetched (#320). Addresses, not names.
+    pub fetch_internal: Vec<String>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
@@ -215,6 +219,7 @@ impl Default for General {
             directory_share: false,
             signals_on_server: false,
             signal_days: 7,
+            fetch_internal: vec![],
         }
     }
 }

crates/ipx/src/directory.rs

@@ -70,7 +70,7 @@ async fn call<T: DeserializeOwned>(
 ) -> Result<T, DirError> {
     let (base, token) = target(&ctx.cfg()).ok_or(DirError::NotConfigured)?;
     let mut req = ctx
-        .client
+        .local_client
         .request(method, format!("{base}{path}"))
         .bearer_auth(token)
         .timeout(std::time::Duration::from_secs(20));

crates/ipx/src/main.rs

@@ -129,8 +129,12 @@ pub struct Ctx {
     /// across an await.
     pub cfg: std::sync::RwLock<std::sync::Arc<config::Config>>,
     pub db: db::Db,
+    /// For anything a feed or a person names: refuses internal addresses (#320).
     pub client: reqwest::Client,
-    /// For feeds only: follows no redirects, so `feed::fetch` sees each hop and can tell a feed
+    /// For the services this server is set up to call, which are on its own network by design:
+    /// the directory, as `http://ipx-directory:8100`. Never for an address a feed or a person names.
+    pub local_client: reqwest::Client,
+    /// For feeds only, refusing internal addresses as `client` does: follows no redirects, so `feed::fetch` sees each hop and can tell a feed
     /// that moved for good from one sent elsewhere for now.
     pub feed_client: reqwest::Client,
     pub out: Emitter,
@@ -353,6 +357,7 @@ async fn main() -> Result<()> {
         Command::Add { .. } | Command::Rm { .. } | Command::Import { .. } | Command::User { cmd: UserCmd::Rm { .. } }
     );
     let (events, _) = broadcast::channel(1024);
+    let guard = feed::guard::Guard::new(feed::guard::Allowed::parse(&cfg.general.fetch_internal)?);
     let ctx = Arc::new(Ctx {
         cfg: std::sync::RwLock::new(std::sync::Arc::new(cfg)),
         db,
@@ -363,12 +368,18 @@ async fn main() -> Result<()> {
             // Two minutes without a byte is a stalled download, however long it is: unbounded, one
             // held the worker, and every scan behind it, for good, while the daemon read healthy (#152).
             .read_timeout(std::time::Duration::from_secs(120))
+            .connector_layer(guard.clone())
+            .build()?,
+        local_client: reqwest::Client::builder()
+            .user_agent(concat!("ipx/", env!("CARGO_PKG_VERSION")))
+            .connect_timeout(std::time::Duration::from_secs(10))
             .build()?,
         feed_client: reqwest::Client::builder()
             .user_agent(concat!("ipx/", env!("CARGO_PKG_VERSION")))
             .connect_timeout(std::time::Duration::from_secs(10))
             .read_timeout(feed::FEED_SILENCE)
             .redirect(reqwest::redirect::Policy::none())
+            .connector_layer(guard)
             .build()?,
         out: if is_daemon { Emitter::socket(events.clone(), false) } else { Emitter::terminal() },
         torrents: tokio::sync::OnceCell::new(),
@@ -2629,6 +2640,7 @@ mod tests {
             cfg: std::sync::RwLock::new(Arc::new(cfg)),
             db: db::Db::memory().await.unwrap(),
             client: reqwest::Client::new(),
+            local_client: reqwest::Client::new(),
             feed_client: reqwest::Client::builder().redirect(reqwest::redirect::Policy::none()).build().unwrap(),
             out: Emitter::terminal(),
             torrents: tokio::sync::OnceCell::new(),