Demo
Demo

Knowledge base

download-blacklist verifiedimportantWritten by the Hub

Addresses the engine will not fetch from

in the configuration this is a linedownload-blacklist: 127.0.0.1/24,192.168.0.0/24

Address ranges the engine refuses to download resources from — the guard against a message template reaching into the local network.

Values

Values
comma-separated ranges
Default
127.0.0.1/24,192.168.0.0/24 · taken from the build
applying
restart required
where it can be set
in the config file · with a startup flag · as an environment variable

In detail

When a message is built from JSON rather than handed over as finished MIME, the engine fetches the images and resources it references. Those references come from whoever composed the message, which makes this a request the node makes on a stranger's instruction — the classic shape of a server-side request forgery. The shipped blacklist covers loopback and one private range, and the ranges as written are odd: 127.0.0.1/24 and 192.168.0.0/24 cover a fraction of what they appear to. The other private ranges — 10/8 and 172.16/12 — are not listed at all. On a node inside a customer's network, that is the difference between a template that cannot reach their internal services and one that can.

What happens if you get it wrong

A node inside a customer's network builds messages from JSON.A template referencing an internal address makes the node fetch it — the private ranges 10/8 and 172.16/12 are not blocked by the shipped list.inference · inference