Skip to content

Commit

Permalink
chore: always execute parse_url in preventLocalAddress
Browse files Browse the repository at this point in the history
This change should make it easier to spot wrong uses of the HTTP client on development setups where allow_local_remote_servers is usually true.

Signed-off-by: Daniel Kesselberg <[email protected]>
  • Loading branch information
kesselb committed Sep 30, 2024
1 parent bb25602 commit a16eb6c
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions lib/private/Http/Client/Client.php
Original file line number Diff line number Diff line change
Expand Up @@ -158,14 +158,15 @@ private function isLocalAddressAllowed(array $options) : bool {
}

protected function preventLocalAddress(string $uri, array $options): void {
if ($this->isLocalAddressAllowed($options)) {
return;
}

$host = parse_url($uri, PHP_URL_HOST);
if ($host === false || $host === null) {
throw new LocalServerException('Could not detect any host');
}

if ($this->isLocalAddressAllowed($options)) {
return;
}

if (!$this->remoteHostValidator->isValid($host)) {
throw new LocalServerException('Host "' . $host . '" violates local access rules');
}
Expand Down

0 comments on commit a16eb6c

Please sign in to comment.