geckon01/php-curl-class
1
0
Fork 0
mirror of https://github.com/php-curl-class/php-curl-class.git synced 2026-09-01 05:02:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve url filtering:

Browse Source 
- Require urls to have a scheme and host
- Allow select ip addresses
This commit is contained in:
Zach Borboa
2018-05-31 23:51:13 -07:00
parent b52e466fa5
commit 402b013c14
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+9 -5
View File
@@ -21,14 +21,18 @@ echo $curl->response;
Safer:
```php
function is_website_url($url, $allowed_schemes = array('http', 'https')) {
$validate_url = !(filter_var($url, FILTER_VALIDATE_URL) === false);
$scheme = parse_url($url, PHP_URL_SCHEME);
return $validate_url && in_array($scheme, $allowed_schemes, true);
function is_allowed_url($url, $allowed_url_schemes = array('http', 'https')) {
$valid_url = filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_SCHEME_REQUIRED | FILTER_FLAG_HOST_REQUIRED) !== false;
if ($valid_url) {
$scheme = parse_url($url, PHP_URL_SCHEME);
return in_array($scheme, $allowed_url_schemes, true);
}
$valid_ip = filter_var($url, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false;
return $valid_ip;
}
$url = $_GET['url'];
if (!is_website_url($url)) {
if (!is_allowed_url($url)) {
die('Unsafe url detected.');
}
```