Implement more comprehensive SSRF mitigation

[SpecLad]

Motivation and context

The current mitigation approach (resolving the IP address and checking if it's in the private range) is insufficient for a few reasons:

• It is susceptible to DNS rebinding (an attacker-controlled DNS name resolving to a public IP address when queried during the check, and to a private IP address afterwards).

• It is susceptible to redirect-based attacks (a server with a public address redirecting to a server with a private address).

• It is only applied when downloading remote files of tasks (and is not easily reusable).

Replace it with an approach based on smokescreen, a proxy that blocks connections to private IP addresses. In addition, use this proxy for webhooks, since they also make requests to untrusted URLs.

The benefits of smokescreen are as follows:

• It's not susceptible to the problems listed above.

• It's configurable, so system administrators can allow certain private IP ranges if necessary. This configurability is exposed via the SMOKESCREEN_OPTS environment variable.

• It doesn't require much code to use.

The drawbacks of smokescreen are:

• It's not as clear when the request fails due to smokescreen (compared to manual IP validation). To compensate, make the error message in _download_data more verbose.

• The smokescreen project seems to be in early development (judging by the 0.0.x version numbers). Still, Stripe itself uses it, so it should be good enough. It's also not very convenient to set up (on account of not providing binaries), so disable it in development environments.

Keep the scheme check from _validate_url. I don't think this check prevents any attacks (as requests only supports http/https to begin with), but it provides a friendly error message in case the user tries to use an unsupported scheme.

How has this been tested?

Manual testing.

Checklist

• I submit my changes into the develop branch
• I have added a description of my changes into the CHANGELOG file
• [ ] I have updated the documentation accordingly
• [ ] I have added tests to cover my changes
• [ ] I have linked related issues (see GitHub docs)
• [ ] I have increased versions of npm packages if it is necessary
  (cvat-canvas,
  cvat-core,
  cvat-data and
  cvat-ui)

License

• I submit my code changes under the same MIT License that covers the project.
  Feel free to contact the maintainers if that's a concern.

[SpecLad]

/check

[github-actions]

✔️ All checks completed successfully
📄 See logs here

[codecov]

Codecov Report

Merging #6362 (8725383) into develop (1f6c63b) will decrease coverage by 0.27%.
The diff coverage is 61.53%.

@@             Coverage Diff             @@
##           develop    #6362      +/-   ##
===========================================
- Coverage    81.20%   80.93%   -0.27%     
===========================================
  Files          322      331       +9     
  Lines        37782    42827    +5045     
  Branches      6821     8368    +1547     
===========================================
+ Hits         30680    34662    +3982     
- Misses        6793     7854    +1061     
- Partials       309      311       +2     

Components	Coverage Δ
cvat-ui	77.05% <ø> (+0.29%)	⬆️
cvat-server	85.32% <61.53%> (+0.14%)	⬆️

[azhavoro]

LGTM