Make https:// and http:// the allowed request protocols by default

README.md

@@ -287,11 +287,13 @@ Curl::setMaximumRedirects($maximum_redirects)
 Curl::setOpt($option, $value)
 Curl::setOpts($options)
 Curl::setPort($port)
+Curl::setProtocols($protocols)
 Curl::setProxy($proxy, $port = null, $username = null, $password = null)
 Curl::setProxyAuth($auth)
 Curl::setProxyTunnel($tunnel = true)
 Curl::setProxyType($type)
 Curl::setRange($range)
+Curl::setRedirectProtocols($redirect_protocols)
 Curl::setReferer($referer)
 Curl::setReferrer($referrer)
 Curl::setRetry($mixed)

SECURITY.md

@@ -35,6 +35,11 @@ $url = $_GET['url'];
 if (!is_allowed_url($url)) {
     die('Unsafe url detected.');
 }
+
+$curl = new Curl();
+$curl->setProtocols(CURLPROTO_HTTPS);
+$curl->setRedirectProtocols(CURLPROTO_HTTPS);
+$curl->get($url);
 ```
 
 ### Url may point to internal urls
@@ -42,6 +47,20 @@ if (!is_allowed_url($url)) {
 * Url may point to internal urls including those behind a firewall (e.g. http://192.168.0.1/ or ftp://192.168.0.1/). Use
   a whitelist to allow certain urls rather than a blacklist.
 
+* Use `Curl::setProtocols()` and `Curl::setRedirectProtocols()` to restrict allowed protocols.
+
+```php
+// Allow only HTTPS protocols.
+$curl->setProtocols(CURLPROTO_HTTPS);
+$curl->setRedirectProtocols(CURLPROTO_HTTPS);
+```
+
+```php
+// Allow HTTPS and HTTP protocols.
+$curl->setProtocols(CURLPROTO_HTTPS | CURLPROTO_HTTP);
+$curl->setRedirectProtocols(CURLPROTO_HTTPS | CURLPROTO_HTTP);
+```
+
 ### Request data may refer to system files
 
 * Request data prefixed with the `@` character may have special interpretation and read from system files.

src/Curl/Curl.php

@@ -1111,6 +1111,20 @@ class Curl extends BaseCurl
         return true;
     }
 
+    /**
+     * Set Protocols
+     *
+     * Limit what protocols libcurl will accept for a request.
+     *
+     * @access public
+     * @param  $protocols
+     * @see    Curl::setRedirectProtocols()
+     */
+    public function setProtocols($protocols)
+    {
+        $this->setOpt(CURLOPT_PROTOCOLS, $protocols);
+    }
+
     /**
      * Set Retry
      *
@@ -1135,6 +1149,20 @@ class Curl extends BaseCurl
         }
     }
 
+    /**
+     * Set Redirect Protocols
+     *
+     * Limit what protocols libcurl will accept when following a redirect.
+     *
+     * @access public
+     * @param  $redirect_protocols
+     * @see    Curl::setProtocols()
+     */
+    public function setRedirectProtocols($redirect_protocols)
+    {
+        $this->setOpt(CURLOPT_REDIR_PROTOCOLS, $redirect_protocols);
+    }
+
     /**
      * Set Url
      *
@@ -1919,6 +1947,9 @@ class Curl extends BaseCurl
      */
     private function initialize($base_url = null, $options = [])
     {
+        $this->setProtocols(CURLPROTO_HTTPS | CURLPROTO_HTTP);
+        $this->setRedirectProtocols(CURLPROTO_HTTPS | CURLPROTO_HTTP);
+
         if (isset($options)) {
             $this->setOpts($options);
         }