DNS rebind bypasses IP check

Code reviewCode quality & reviewSenior–Staff~35 min

Review this Python webhook/avatar fetcher that already blocks internal IPs.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 35 min

Mark a line and say what kind of problem it is.0 findings

1import ipaddress, socket, requests

2from urllib.parse import urlparse

4def fetch_avatar(url):

5 host = urlparse(url).hostname

6 ip = ipaddress.ip_address(socket.gethostbyname(host))

7 if ip.is_private or ip.is_loopback or ip.is_link_local:

8 raise ValueError('blocked internal address')

9 resp = requests.get(url, timeout=5)

10 return resp.content

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.