p3k
/
http
1
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 14 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
20 Commits
1 Branch
273 KiB
Tree: 98b1aa07c9
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '98b1aa07c9'
${ noResults }
http/tests/server/index.php

7 lines
217 B
Raw Normal View History

Add safe mode for fetching untrusted URLs set_safe_mode(true) refuses anything but http and https, refuses hosts that resolve to loopback, private, link-local or reserved addresses, pins curl to the addresses that were checked (no DNS rebinding), and follows redirects one hop at a time so each is checked, dropping credentials when a redirect changes origin. Hosts or ranges can be allowed explicitly for development servers. Off by default. Adds a PHPUnit suite. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 days ago
​
​
​
​
​
​
 
  1. <?php
  2. // For CurlPinningTest: echoes the Host header, or redirects when asked.

  3. if(($_GET['to'] ?? '') !== '') {
  4.   header('Location: ' . $_GET['to'], true, 302);
  5.   exit;
  6. }
  7. echo 'host=' . ($_SERVER['HTTP_HOST'] ?? '');