Class RemoteImageOptions

Namespace

DocToolkit

Assembly

DocToolkit.dll

Bounds the one code path in this library that opens a socket: fetching images named by absolute URLs during HTML conversion. Every default here is the restrictive one, so new RemoteImageOptions() is safe to pass without reading this class.

This is not a complete SSRF defence. Host addresses are resolved and checked, then resolved again by the HTTP stack when it connects — a DNS entry that changes between those two moments defeats the check. It stops the ordinary cases, a literal metadata address or a hard-coded internal hostname, and raises the cost of the rest; a service converting genuinely untrusted HTML should also be egress-filtered at the network layer.

public sealed class RemoteImageOptions

Inheritance

object

RemoteImageOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Properties

AllowPrivateAddresses

Whether loopback, private and link-local addresses may be fetched. Default false, which is what keeps 169.254.169.254 — the cloud metadata endpoint — and internal services out of reach of attacker-supplied markup.

public bool AllowPrivateAddresses { get; set; }

Property Value

bool

AllowedHosts

Hosts that may be fetched from, compared case-insensitively. Empty — the default — means any host that also passes the address check; it does not disable that check.

public ISet<string> AllowedHosts { get; }

Property Value

ISet<string>

MaxBytesPerImage

The most bytes accepted from a single image. Default 5 MB. Enforced while reading the response body, not taken from Content-Length, which a hostile server can understate.

public long MaxBytesPerImage { get; set; }

Property Value

long

Timeout

How long a single image fetch may take. Default 10 seconds.

public TimeSpan Timeout { get; set; }

Property Value

TimeSpan