mirror of https://github.com/pixelfed/pixelfed
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
3d82a8e8b2
The remote media path validated URLs only as strings (Helpers::validateUrl normalizes the host + checks a ban list) and then downloaded them with Http::head + file_get_contents($url), which resolve DNS themselves and follow redirects with no private-IP checks and no address pinning. A remote actor whose icon.url redirected to an internal address (e.g. 172.18.0.1 or 169.254.169.254) made the queue worker fetch internal content and, for image responses, republish it at a public avatar URL. No account required. Fixes: - Add SecureMediaFetchService: validates URL, resolves + rejects non-global IPs (fail-closed), pins the connection to the validated IP via CURLOPT_RESOLVE, disables auto-redirects with per-hop re-validation, and enforces https-only + a byte cap. Mirrors the ActivityPubFetchService hardening from CVE-2026-71246. - Route MediaStorageService head()/fetchAvatar()/remoteToCloud() through it, removing the bare Http::head and file_get_contents($url) sinks. - validateUrl(): when DNS verification is enabled, reject hosts that resolve into reserved ranges, closing the metadata.google.internal bypass. - Harden adjacent same-class sinks: CustomEmojiService (emoji doc + image + head), FetchCacheService/webfinger, and DiscoverActor. - Add regression tests (tests/Unit/ActivityPub/SsrfUrlValidationTest.php). |
4 weeks ago | |
|---|---|---|
| .. | ||
| ActivityPub | 4 weeks ago | |
| Lexer | 4 weeks ago | |
| APAnnounceStrategyTest.php | 4 weeks ago | |
| ActivityPubTagObjectTest.php | 4 weeks ago | |
| BearcapTest.php | 4 weeks ago | |
| CryptoTest.php | 4 weeks ago | |
| CuratedOnboardingNotifyAdminTest.php | 4 weeks ago | |
| ExampleTest.php | 1 year ago | |
| PurifierTest.php | 4 weeks ago | |
| RestrictedAccessMiddlewareTest.php | 4 weeks ago | |
| WebfingerTest.php | 4 weeks ago | |