The_Great_Archive/ArchiveBox
1
0
Fork 0
mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-09-12 19:50:57 +05:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Enhance security note on URL archiving
Some checks failed
CI / Linters (push) Has been cancelled
Details
CI / Install and CLI platform compatibility (push) Has been cancelled
Details
CI / Discovered test matrix (push) Has been cancelled
Details
CI / Documentation and root tests (push) Has been cancelled
Details
CI / CodeQL (push) Has been cancelled
Details
CI / Tested Python artifacts (push) Has been cancelled
Details
CI / Tested Docker images (push) Has been cancelled
Details
CI / All required CI lanes (push) Has been cancelled
Details

Browse Source 
Updated the note on URL archiving to include firewall/ACL-level blocking recommendations.
This commit is contained in:
Nick Sweeting 2026-08-03 16:15:58 -04:00 committed by GitHub
parent 08226dd944
commit da134b3154
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/SECURITY.md vendored
View File

@ -64,5 +64,5 @@ Non-logged in users should be tightly limited to prevent attacks like SQL/shell
### SSRF / URL Validation
Note archivebox is **designed to be able to archive any URL the server can reach**, including internal intranet URLs, private IPs, and localhost. Users are expected to configure `URL_ALLOWLIST`/`URL_DENYLIST` accordingly if they need to limit what the server should archive.
Note archivebox is **designed to be able to archive any URL the server can reach**, including internal intranet URLs, private IPs, and localhost. Users are expected to configure `URL_ALLOWLIST`/`URL_DENYLIST` or proper firewall/ACL-level blocking at the network level if they need to limit what the server should see.
It does a basic check to try and avoid recursively archiving snapshots hosted by the archivebox server itself, but it's not a strict security check, it's just to prevent wasted CPU/disk from recursively archiving snapshots in a browser that has the ArchiveBox Browser Extension turned on.