Allow to pass env variables to python runtime for Changedetection

[SansGuidon]

Hey
I notice some watches in my changedetection instance are errored with a message about an environment variable to set somewhere

After I set this variable in env.sh, the variable is available in the container but is not passed to the context of the python3 runtime / changedetection.py, if someone can confirm my assumption?
https://git.cloudron.io/packages/changedetection-app/-/blob/master/start.sh?ref_type=heads so the error persists in changedetection

If I'm not mistaken then, it could be enough to adapt the package's Dockerfile around https://git.cloudron.io/packages/changedetection-app/-/blob/master/start.sh?ref_type=heads#L25 so the env variables sourced from env.sh are taken into account by the python runtime?

Refs / examples usage

• https://github.com/dgtlmoon/changedetection.io/commit/bf3f8eae45b2be7bb54e10cf74f8bf8456456b42
• https://github.com/dgtlmoon/changedetection.io/commit/fe7aa38c651d73fe5f41ce09855fa8f97193747b

Thanks for reading and review/feedback! I hope this is not a case of a https://xyproblem.info/

[james]

Hello @sansguidon
Can you give me a step by step guide to reproduce this issue?

[SansGuidon]

@james I've sent you in PM an example problematic url

[SansGuidon]

changedetection watch fails with:

Fetch blocked: 'https://my.domain.tld/' resolves to a private/reserved IP address

However the domain resolves to public IPs:

A <redacted public ipv4>
AAAA <redacted public ipv6>

Inside the container:

dig my.domain.tld -> <redacted public ipv4>
getent hosts -> <redacted public ipv6>

Both IPv4 and IPv6 connectivity work (curl -4 and curl -6 succeed).

So DNS and networking are fine. The issue appears to be the SSRF protection in changedetection misclassifying the resolved IPv6 address as private/reserved.

Setting:

ALLOW_IANA_RESTRICTED_ADDRESSES=true

should bypass the block and the fetch works but if I set that in env.sh, nothing changes because the changedetection python command that is run does not read those env

Looks like a false positive triggered when the resolver prefers the IPv6 address.

[robi]

Something has to run env.sh
Does the startup script do it?

Does it work if you set it manually?