Merge pull request #71 from fruechel-canva/main

Add exclusion patterns for curl-unecrypted-url

Author: mschwager

generic/curl-unencrypted-url.sh

@@ -13,4 +13,13 @@ curl https://google.com > /dev/null
 curl http://localhost > /dev/null
 
 # ok: curl-unencrypted-url
-curl http://127.0.0.1 > /dev/null
+curl http://127.0.0.1 > /dev/null
+
+# ok: curl-unencrypted-url
+curl http://169.254.169.254 > /dev/null
+#
+# ok: curl-unencrypted-url
+curl http://[fd00:ec2::254] > /dev/null
+
+# ok: curl-unencrypted-url
+curl http://metadata.google.internal > /dev/null

generic/curl-unencrypted-url.yaml

@@ -19,3 +19,6 @@ rules:
           - pattern: curl ... ftp://
       - pattern-not-inside: curl ... http://127.0.0.1
       - pattern-not-inside: curl ... http://localhost
+      - pattern-not-inside: curl ... http://169.254.169.254
+      - pattern-not-inside: curl ... http://[fd00:ec2::254]
+      - pattern-not-inside: curl ... http://metadata.google.internal