PDF Converter Server-Side Request Forgery Prevention Configuration

<BlackListDomains name="name1">internal.denallix.com</BlackListDomains>
<BlackListDomains name="name2">evil.com</BlackListDomains>

*See note

• Blocks all requests to the domains that are in the list.
• Each entry’s name attribute must be unique but can be set to any value to describe the rule.
• We do not recommend using this setting on its own as it would be easy to miss certain internal endpoints which could lead to compromise.

<WhiteListDomains name="name1">k2.denallix.com</WhiteListDomains>
<WhiteListDomains name="name2">external.denallix.com</WhiteListDomains>

*See note

• Allows requests to the domains specified in the list and blocks all other requests.
• If a request uses the IP address of the site instead of the configured value, it will still block the request. In other words, if the request isn’t to the exact value configured in the list, it will be blocked.
• Each entry’s name attribute must be unique but can be set to any value to describe the rule.
• For security purposes this is the most restrictive and recommended option as it allows only what is absolutely necessary.

<BlackListIPAddresses name="name1">10.1.3.15</BlackListIPAddresses>
<BlackListIPAddresses name="name2">198.4.200.3</BlackListIPAddresses>

• Blocks all requests where the IP address of the request resolves to an address in the configured list.
• Each entry’s name attribute must be unique but can be set to any value to describe the rule.
• We do not recommend using this setting on its own as it would be easy to miss certain internal endpoints which could lead to compromise.

<WhiteListIPAddresses name="name1">10.1.10.23</WhiteListIPAddresses>
<WhiteListIPAddresses name="name2">192.168.30.200</WhiteListIPAddresses>

*See note

• Allows all requests that resolves to the IP Addresses in the list and blocks all other requests.
• Each entry’s name attribute must be unique but can be set to any value to describe the rule.
• Although this option is very restrictive, it does require the system administrator to understand exactly what is available on a certain IP address. For example, two sites on the same machine could resolve to the same IP address, but are only differentiated by a host header. If one of these sites must be inaccessible to PDF conversion, then this setting alone is not sufficient.

<BlackListSubnets name="name1">
      <IpAddress>1.1.1.1</IpAddress>
      <Mask>255.255.0.0</Mask>
</BlackListSubnets>
<BlackListSubnets name="name2">
      <IpAddress>2.2.2.2</IpAddress>
      <Mask>255.255.0.0</Mask>
</BlackListSubnets>

• The IpAddress gives the base of the restriction where the Mask indicates what range in the subnet it applies to.
• Each entry’s name attribute must be unique but can be set to any value to describe the rule.
• This setting blocks all requests where the IP address of the request resolves to an address in the subnet range.

<WhiteListSubnets name="name1">
      <IpAddress>1.1.1.1</IpAddress>
      <Mask>255.255.0.0</Mask>
</WhiteListSubnets>
<WhiteListSubnets name="name2">
      <IpAddress>2.2.2.2</IpAddress>
      <Mask>255.255.0.0</Mask>
</WhiteListSubnets>

• The IpAddress gives the base of the restriction where the Mask indicates what range in the subnet it applies to.
• Each entry’s name attribute must be unique, but can be set to any value to describe the rule.
• This setting allows all requests that resolves to an IP address within the subnet range and blocks all other requests.

• If this setting is true, all requests that resolves to 127.0.0.1 or to any IP address that is within the same subnet of the machine where the PDF converter service is running will be blocked.
• This option is useful to make sure no internal endpoints are discovered or interacted with.

<BlockLocalExclusions name="name2">k2.denallix.com:443</BlockLocalExclusions>
 <BlockLocalExclusions name="name1">k2.denallix.com:80</BlockLocalExclusions>

• This setting only applies when BlockLocalIpAddresses is set to true.
• If a port number is supplied, only that specific address on that port is unblocked.
• This setting is required when BlockLocalIpAddresses is set to true and when the SmartForms site is installed on the same machine or subnet of the K2Server.
  When configured, it resolves the host in the config file to an IP address and then checks all requests against the IP address and port (if specified) and if it matches, it then allows the request to go through. For example, if configured for k2.denallix.com:443, the address may resolve to 127.0.0.1. If a request comes in for external.denallix.com:443 and it resolves to 127.0.0.1, it will be allowed. In other words, everything on the same IP address and port is allowed regardless of the host header. In this scenario, if external.denallix.com must be blocked, you must add it to the BlackListDomains config setting.