Merge commit from fork

[2.1] Rejects internal/loopback/link-local fetch targets in fetch_web_data()

Author: Sesquipedalian

Sources/Class-CurlFetchWeb.php

@@ -340,6 +340,16 @@ private function set_options()
 	 */
 	private function redirect($target_url, $referer_url)
 	{
+		// SSRF guard: re-validate the redirect target before following it, so a
+		// 302 -> http://127.0.0.1/ (or link-local cloud metadata) is refused.
+		if (!is_fetch_safe($target_url))
+		{
+			if (isset($this->response[$this->current_redirect - 1]))
+				$this->response[$this->current_redirect - 1]['success'] = false;
+
+			return;
+		}
+
 		// no no I last saw that over there ... really, 301, 302, 307
 		$this->set_options();
 		$this->options[CURLOPT_REFERER] = $referer_url;

Sources/Subs.php

@@ -4030,8 +4030,15 @@ function get_proxied_url($url)
 	$parsedurl = parse_iri($url);
 
 	// Don't bother with HTTPS URLs, schemeless URLs, or obviously invalid URLs
-	// Don't proxy localhost or IP addresses, either
-	if (empty($parsedurl['scheme']) || empty($parsedurl['host']) || empty($parsedurl['path']) || $parsedurl['scheme'] === 'https' || $parsedurl['host'] === 'localhost' || filter_var($parsedurl['host'], FILTER_VALIDATE_IP) !== false)
+	if (empty($parsedurl['scheme']) || empty($parsedurl['host']) || empty($parsedurl['path']) || $parsedurl['scheme'] === 'https')
+		return $url;
+
+	// Don't proxy URLs whose hosts are private or reserved IP addresses
+	if (filter_var($parsedurl['host'], FILTER_VALIDATE_IP) !== false && filter_var($parsedurl['host'], FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE | FILTER_FLAG_NO_PRIV_RANGE) === false)
+		return $url;
+
+	// Don't proxy URLs with domains that aren't part of public DNS
+	if (preg_match('/\b(?' . '>example|local(?' . '>host)?|onion|test|alt|in(?' . '>ternal|valid))$/', $parsedurl['host']))
 		return $url;
 
 	// We don't need to proxy our own resources
@@ -6117,6 +6124,15 @@ function fetch_web_data($url, $post_data = '', $keep_alive = false, $redirection
 	global $webmaster_email, $sourcedir, $txt;
 	static $keep_alive_dom = null, $keep_alive_fp = null;
 
+	// SSRF guard: refuse loopback/private/link-local/reserved targets and
+	// non-fetchable schemes before any connection is attempted.
+	if (!is_fetch_safe($url))
+	{
+		loadLanguage('Errors');
+		trigger_error($txt['fetch_web_data_bad_url'], E_USER_NOTICE);
+		return false;
+	}
+
 	preg_match('~^(http|ftp)(s)?://([^/:]+)(:(\d+))?(.+)$~', iri_to_url($url), $match);
 
 	// No scheme? No data for you!
@@ -6285,6 +6301,64 @@ function fetch_web_data($url, $post_data = '', $keep_alive = false, $redirection
 	return $data;
 }
 
+/**
+ * Decides whether a URL is safe to fetch from the server.
+ *
+ * Rejects URLs whose scheme is not in the fetchable set, and URLs whose
+ * host resolves (or is) a non-global IP address: loopback, private,
+ * link-local (incl. 169.254.0.0/16 cloud metadata), or other reserved
+ * ranges. This is the single chokepoint that prevents the avatar, proxy,
+ * get_mime_type, and task fetchers from being used as SSRF primitives. It is
+ * also re-applied to each redirect target by the fetchers.
+ *
+ * @param string $url The URL to check.
+ * @return bool True if the URL is safe to fetch, false otherwise.
+ */
+function is_fetch_safe($url)
+{
+	static $safe_hosts = array();
+
+	$parsedurl = parse_iri(iri_to_url($url));
+
+	if (empty($parsedurl['scheme']) || !in_array($parsedurl['scheme'], array('http', 'https', 'ftp', 'ftps')) || empty($parsedurl['host']) || preg_match('/\b(?' . '>example|local(?' . '>host)?|onion|test|alt|in(?' . '>ternal|valid))$/', $parsedurl['host']))
+		return false;
+
+	// Avoid unnecessary repetition.
+	if (isset($safe_hosts[$parsedurl['host']]))
+		return $safe_hosts[$parsedurl['host']];
+
+	// Resolve the host to its address(es). A literal IP resolves to itself.
+	$ips = array();
+
+	if (filter_var($parsedurl['host'], FILTER_VALIDATE_IP) !== false)
+	{
+		$ips[] = $parsedurl['host'];
+	}
+	else
+	{
+		$records = @dns_get_record($parsedurl['host'], DNS_A | DNS_AAAA);
+
+		foreach ((array) $records as $record)
+		{
+			if (!empty($record['ip']))
+				$ips[] = $record['ip'];
+
+			if (!empty($record['ipv6']))
+				$ips[] = $record['ipv6'];
+		}
+	}
+
+	$safe_hosts[$parsedurl['host']] = !empty($ips) && $ips === array_filter(
+		$ips,
+		function ($ip)
+		{
+			return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE | FILTER_FLAG_NO_PRIV_RANGE);
+		}
+	);
+
+	return $safe_hosts[$parsedurl['host']];
+}
+
 /**
  * Attempts to determine the MIME type of some data or a file.
  *

proxy.php

@@ -125,9 +125,6 @@ public function checkRequest()
 			if (!mkdir($this->cache) || !copy(dirname($this->cache) . '/index.php', $this->cache . '/index.php'))
 				return false;
 
-		// Basic sanity check
-		$_GET['request'] = validate_iri($_GET['request']);
-
 		// We aren't going anywhere without these
 		if (empty($_GET['hash']) || empty($_GET['request']))
 			return false;
@@ -137,9 +134,12 @@ public function checkRequest()
 
 		// Just in case...
 		if (
-			filter_var(parse_url($request, PHP_URL_HOST), FILTER_VALIDATE_IP) !== false
-			|| parse_url($request, PHP_URL_HOST) === 'localhost'
+			// Basic sanity check.
+			!validate_iri($request)
+			// Don't proxy our own resources.
 			|| parse_url($request, PHP_URL_HOST) === parse_url($boardurl, PHP_URL_HOST)
+			// SSRF protection: don't proxy localhost, private or reserved IPs, etc.
+			|| !is_fetch_safe($request)
 		) {
 			return false;
 		}