From 402b013c14f61597d9148c0a0a9e2cd4fdc37df2 Mon Sep 17 00:00:00 2001 From: Zach Borboa Date: Thu, 31 May 2018 23:51:13 -0700 Subject: [PATCH] Improve url filtering: - Require urls to have a scheme and host - Allow select ip addresses --- SECURITY.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 2ad4b80..12d5553 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -21,14 +21,18 @@ echo $curl->response; Safer: ```php -function is_website_url($url, $allowed_schemes = array('http', 'https')) { - $validate_url = !(filter_var($url, FILTER_VALIDATE_URL) === false); - $scheme = parse_url($url, PHP_URL_SCHEME); - return $validate_url && in_array($scheme, $allowed_schemes, true); +function is_allowed_url($url, $allowed_url_schemes = array('http', 'https')) { + $valid_url = filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_SCHEME_REQUIRED | FILTER_FLAG_HOST_REQUIRED) !== false; + if ($valid_url) { + $scheme = parse_url($url, PHP_URL_SCHEME); + return in_array($scheme, $allowed_url_schemes, true); + } + $valid_ip = filter_var($url, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false; + return $valid_ip; } $url = $_GET['url']; -if (!is_website_url($url)) { +if (!is_allowed_url($url)) { die('Unsafe url detected.'); } ```