XBOW-025-016 - SSRF via HTTP Attachment Addressed

[caronc]

Description:

Related issue (if applicable): refs #230

This code merge ONLY impacts situations where a HTTP web request is provided as an Attachment Source. The Apprise API will retrive the contents and forward it along with the notification.

This solution adds 2 new variable system parameters that can be over-ridden using their respected environment variable (same name)

• APPRISE_ATTACH_DENY_URLS: Defaults to: '127.0.* localhost*
• APPRISE_ATTACH_ALLOW_URLS: Defaults to *

The idea is to grant the system owner hosting Apprise API a means of having control over what attachments can be retrieved by their server.

Deny list is always processed first, and thne the Allow list. If no match is found on the Allow list, then the URL specified is rejected.

Both lists support all sorts of combinations:

• host/addr: e.g. localhost, localhost*, 127.0.0.*, 192.168.0.*, localhost:8000
• schema/host/addr: e.g https://localhost, http://localhost:3000
• schema/host/addr/path: e.g https://localhost/attach, https:/myserver/path/to/*/dir
• host/addr/path: e.g localhost/attach, my.server:3000/incoming/

when no schema is defined, it is implied that you are accepting both http and https. When a schema is defined, it is implict. If you define https and only pass in http, it will not match.

You can use the * wildcard which behaves slightly different in the hostname and/or path. The path is the most notable as the * can not pass through paths (separated by /).

You also do not need to specify a * a the end of a path as it is implied. Consider the definition https://localhost:8000/my-files/. This translates under the hood as https://localhost:8000/my-files/.*. Thus the following is accepted:

• https://localhost:8000/my-files/path1/
• https://localhost:8000/my-files/path1/path2/

The other character you can define in your string is ? which can subsitute for any single character. e.g: http://my-server??/static/?? could accept valid entries such as http://my-server12/static/ab/test.jpg for example.

Checklist

• The code change is tested and works locally.
• There is no commented out code in this PR.
• No lint errors (use flake8)
• Tests added