Binding to an Unrestricted IP Address in http.server Module
Sockets can be bound to the IPv4 address 0.0.0.0 or IPv6 equivalent of
::, which configures the socket to listen for incoming connections on all
network interfaces. While this can be intended in environments where
services are meant to be publicly accessible, it can also introduce significant
security risks if the service is not intended for public or wide network
access.
Binding a socket to 0.0.0.0 or :: can unintentionally expose the
application to the wider network or the internet, making it accessible from
any interface. This exposure can lead to unauthorized access, data breaches,
or exploitation of vulnerabilities within the application if the service is
not adequately secured or if the binding is unintended. Restricting the socket
to listen on specific interfaces limits the exposure and reduces the attack
surface.
Example
from http.server import BaseHTTPRequestHandler
from http.server import HTTPServer
def run(server_class: HTTPServer, handler_class: BaseHTTPRequestHandler):
server_address = ("", 8000)
httpd = server_class(server_address, handler_class)
httpd.serve_forever()
Remediation
All socket bindings MUST specify a specific network interface or localhost (127.0.0.1/localhost for IPv4, ::1 for IPv6) unless the application is explicitly designed to be accessible from any network interface. This practice ensures that services are not exposed more broadly than intended.
from http.server import BaseHTTPRequestHandler
from http.server import HTTPServer
def run(server_class: HTTPServer, handler_class: BaseHTTPRequestHandler):
server_address = ("127.0.0.1", 8000)
httpd = server_class(server_address, handler_class)
httpd.serve_forever()
False Positives
In the case of a false positive the rule can be suppressed. Simply add a
trailing or preceding comment line with either the rule ID (PY031) or
rule category name (unrestricted_bind).
- Using rule ID
- Using category name
from http.server import BaseHTTPRequestHandler
from http.server import HTTPServer
def run(server_class: HTTPServer, handler_class: BaseHTTPRequestHandler):
server_address = ("", 8000)
# suppress: PY031
httpd = server_class(server_address, handler_class)
httpd.serve_forever()
from http.server import BaseHTTPRequestHandler
from http.server import HTTPServer
def run(server_class: HTTPServer, handler_class: BaseHTTPRequestHandler):
server_address = ("", 8000)
# suppress: unrestricted_bind
httpd = server_class(server_address, handler_class)
httpd.serve_forever()