p3k/http - http - Gitea

https://github.com/aaronpk/p3k-http

11 lines

311 B

Raw Normal View History

Add safe mode for fetching untrusted URLs set_safe_mode(true) refuses anything but http and https, refuses hosts that resolve to loopback, private, link-local or reserved addresses, pins curl to the addresses that were checked (no DNS rebinding), and follows redirects one hop at a time so each is checked, dropping credentials when a redirect changes origin. Hosts or ranges can be allowed explicitly for development servers. Off by default. Adds a PHPUnit suite. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 days ago

Only use HTTP/2 over TLS, and HTTP/1.1 for plain http Requesting CURL_HTTP_VERSION_2 makes curl send an h2c Upgrade request on plain http URLs, which some servers mishandle. PHP 7.3's built-in server drops the connection, which failed the curl tests on PHP 7.3. Use CURL_HTTP_VERSION_2TLS instead, curl's own default since 7.62: https still negotiates HTTP/2. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

1 day ago

Add safe mode for fetching untrusted URLs set_safe_mode(true) refuses anything but http and https, refuses hosts that resolve to loopback, private, link-local or reserved addresses, pins curl to the addresses that were checked (no DNS rebinding), and follows redirects one hop at a time so each is checked, dropping credentials when a redirect changes origin. Hosts or ranges can be allowed explicitly for development servers. Off by default. Adds a PHPUnit suite. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 days ago

<?php
// For CurlPinningTest: echoes the Host header, or redirects when asked.
if(($_GET['to'] ?? '') !== '') {
  header('Location: ' . $_GET['to'], true, 302);
  exit;
}
if(isset($_GET['upgrade'])) {
  echo 'upgrade=' . ($_SERVER['HTTP_UPGRADE'] ?? '');
  exit;
}
echo 'host=' . ($_SERVER['HTTP_HOST'] ?? '');