Skip to content

FYST-2343: copy kevin's test showing from gyraffe that we don't use the DNS-lookup validators in validemail2 - #407

Open
mrotondo wants to merge 2 commits into
mainfrom
FYST-2343-pya-pentest-remediate-blind-ssrf-via-dns-resolution-in-email-validation-valid-email-2-gem
Open

FYST-2343: copy kevin's test showing from gyraffe that we don't use the DNS-lookup validators in validemail2#407
mrotondo wants to merge 2 commits into
mainfrom
FYST-2343-pya-pentest-remediate-blind-ssrf-via-dns-resolution-in-email-validation-valid-email-2-gem

Conversation

@mrotondo

@mrotondo mrotondo commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

https://codeforamerica.atlassian.net/browse/FYST-2343

PYA pentest finding:

The valid_email2 gem performs DNS resolution (MX/A record lookups) on submitted email domains. This allows an attacker to trigger outbound DNS connections from the server to arbitrary attacker-controlled domains, potentially enabling DNS rebinding attacks against internal services.

This PR adds a test showing that we don't use the DNS-lookup-based validations that valid_email2 includes.

@mrotondo mrotondo changed the title copy kevin's test showing from gyraffe that we don't use the DNS-lookup validators in validemail2 FYST-2343: copy kevin's test showing from gyraffe that we don't use the DNS-lookup validators in validemail2 Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant