Laravel SSRF Guard

https://github.com/jeffersongoncalves/laravel-ssrf-guard
Admin
Laravel SSRF Guard protects outbound HTTP requests from Server-Side Request Forgery (SSRF) by...
Tokens:3,430
Snippets:24
Trust Score:9.8
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install laravel-ssrf-guard via Composer

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Install the package via Composer.

```bash
composer require jeffersongoncalves/laravel-ssrf-guard
```

--------------------------------

### Get curl resolve pin with resolveEntries

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Get validated CURLOPT_RESOLVE entries for a URL. Returns null for non-public or unsupported URLs.

```php
$resolve = app(SsrfGuard::class)->resolveEntries('https://example.com');
// ['example.com:443:93.184.216.34']  (or null if not public)
```

--------------------------------

### Publish ssrf-guard config

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Publish the package configuration file.

```bash
php artisan vendor:publish --tag="ssrf-guard-config"
```

--------------------------------

### Running Tests and Analysis

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/resources/boost/skills/ssrf-guard-development/SKILL.md

Commands to run all tests, run tests with coverage, perform static analysis, and check code style.

```bash
vendor/bin/pest            # all tests
vendor/bin/pest --coverage # with coverage
vendor/bin/phpstan analyse # static analysis (level 5)
vendor/bin/pint            # code style
```

--------------------------------

### Pass extra options to safeGet

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Pass extra HTTP Client options to safeGet(); they are merged over the safe defaults.

```php
$response = app(SsrfGuard::class)->safeGet($url, [
    'headers' => ['Accept' => 'image/*'],
]);
```

--------------------------------

### Fetch URL safely with safeGet

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Fetch a URL safely with safeGet(). Throws BlockedHostException if the URL or any redirect hop is not public. Returns a standard Illuminate\Http\Client\Response.

```php
use JeffersonGoncalves\SsrfGuard\SsrfGuard;
use JeffersonGoncalves\SsrfGuard\Exceptions\BlockedHostException;

try {
    $response = app(SsrfGuard::class)->safeGet($untrustedUrl);

    $body = $response->body();
} catch (BlockedHostException $e) {
    report($e);
    // The URL pointed at a non-public host — refuse to proxy it.
}
```

--------------------------------

### Published ssrf-guard config file

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Published config file with defaults: timeout 8s, max_redirects 5, allowed schemes http/https, allow_private false, max_response_size 10 MiB. All values can be overridden via environment variables.

```php
return [
    'timeout' => (int) env('SSRF_GUARD_TIMEOUT', 8),
    'max_redirects' => (int) env('SSRF_GUARD_MAX_REDIRECTS', 5),
    'allowed_schemes' => ['http', 'https'],
    'allow_private' => (bool) env('SSRF_GUARD_ALLOW_PRIVATE', false),
    'max_response_size' => (int) env('SSRF_GUARD_MAX_RESPONSE_SIZE', 10 * 1024 * 1024),
];
```

--------------------------------

### SSRF Guard Pest Tests

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/resources/boost/skills/ssrf-guard-development/SKILL.md

Pest test cases for the SSRF guard, covering blocking of loopback, private, link-local addresses, non-http schemes, and successful resolution of public IPs. Includes a test for `safeGet` throwing a `BlockedHostException` on private hosts.

```php
use JeffersonGoncalves\SsrfGuard\SsrfGuard;
use JeffersonGoncalves\SsrfGuard\Exceptions\BlockedHostException;

beforeEach(fn () => $this->guard = new SsrfGuard);

it('blocks loopback / private / link-local', function () {
    expect($this->guard->isPublicUrl('http://127.0.0.1'))->toBeFalse();
    expect($this->guard->isPublicUrl('http://10.0.0.1'))->toBeFalse();
    expect($this->guard->isPublicUrl('http://169.254.169.254'))->toBeFalse();
});

it('blocks non-http schemes', function () {
    expect($this->guard->isPublicUrl('ftp://1.1.1.1'))->toBeFalse();
});

it('allows and pins a public IP', function () {
    expect($this->guard->resolveEntries('http://1.1.1.1'))->toBe(['1.1.1.1:80:1.1.1.1']);
});

it('throws on safeGet to a private host', function () {
    $this->guard->safeGet('http://127.0.0.1');
})->throws(BlockedHostException::class);
```

--------------------------------

### Check URL safety with isPublicUrl

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Check whether a URL is safe to fetch. Returns true for public URLs, false for loopback, private, link-local, or disallowed schemes.

```php
use JeffersonGoncalves\SsrfGuard\SsrfGuard;

$guard = app(SsrfGuard::class);

$guard->isPublicUrl('https://example.com');     // true
$guard->isPublicUrl('http://127.0.0.1');        // false (loopback)
$guard->isPublicUrl('http://10.0.0.1');         // false (private)
$guard->isPublicUrl('http://169.254.169.254');  // false (link-local / metadata)
$guard->isPublicUrl('ftp://example.com');       // false (scheme not allowed)
```

--------------------------------

### Validate user input with isPublicUrl

Source: https://github.com/jeffersongoncalves/laravel-ssrf-guard/blob/master/README.md

Validate user input before storing or fetching it. Aborts with 422 if the URL is not public.

```php
if (! app(SsrfGuard::class)->isPublicUrl($request->input('webhook_url'))) {
    abort(422, 'The URL must point to a public host.');
}
```
Tokens:
Raw