Skip to content

Commit

Permalink
Merge branch '7.1' into 7.2
Browse files Browse the repository at this point in the history 
* 7.1:
  [HttpClient] Fix checking for private IPs before connecting
  • Loading branch information
@nicolas-grekas
nicolas-grekas committed Nov 27, 2024
2 parents 3d49526 + 2ec4972 commit e961ee6
Show file tree
Hide file tree
Showing 10 changed files with 251 additions and 84 deletions.
11 changes: 1 addition & 10 deletions NativeHttpClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -140,22 +140,13 @@ public function request(string $method, string $url, array $options = []): Respo

if ($onProgress = $options['on_progress']) {
$maxDuration = 0 < $options['max_duration'] ? $options['max_duration'] : \INF;
$multi = $this->multi;
$resolve = static function (string $host, ?string $ip = null) use ($multi): ?string {
if (null !== $ip) {
$multi->dnsCache[$host] = $ip;
}

return $multi->dnsCache[$host] ?? null;
};
$onProgress = static function (...$progress) use ($onProgress, &$info, $maxDuration, $resolve) {
$onProgress = static function (...$progress) use ($onProgress, &$info, $maxDuration) {
if ($info['total_time'] >= $maxDuration) {
throw new TransportException(\sprintf('Max duration was reached for "%s".', implode('', $info['url'])));
}

$progressInfo = $info;
$progressInfo['url'] = implode('', $info['url']);
$progressInfo['resolve'] = $resolve;
unset($progressInfo['size_body']);

// Memoize the last progress to ease calling the callback periodically when no network transfer happens
Expand Down
194 changes: 161 additions & 33 deletions NoPrivateNetworkHttpClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,11 @@

use Psr\Log\LoggerAwareInterface;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpClient\Exception\InvalidArgumentException;
use Symfony\Component\HttpClient\Exception\TransportException;
use Symfony\Component\HttpClient\Response\AsyncContext;
use Symfony\Component\HttpClient\Response\AsyncResponse;
use Symfony\Component\HttpFoundation\IpUtils;
use Symfony\Contracts\HttpClient\ChunkInterface;
use Symfony\Contracts\HttpClient\HttpClientInterface;
use Symfony\Contracts\HttpClient\ResponseInterface;
use Symfony\Contracts\HttpClient\ResponseStreamInterface;
Expand All @@ -25,68 +27,135 @@
* Decorator that blocks requests to private networks by default.
*
* @author Hallison Boaventura <hallisonboaventura@gmail.com>
* @author Nicolas Grekas <p@tchwork.com>
*/
final class NoPrivateNetworkHttpClient implements HttpClientInterface, LoggerAwareInterface, ResetInterface
{
use HttpClientTrait;
use AsyncDecoratorTrait;

private array $defaultOptions = self::OPTIONS_DEFAULTS;
private HttpClientInterface $client;
private array|null $subnets;
private int $ipFlags;
private \ArrayObject $dnsCache;

/**
* @param string|array|null $subnets String or array of subnets using CIDR notation that will be used by IpUtils.
* @param string|array|null $subnets String or array of subnets using CIDR notation that should be considered private.
* If null is passed, the standard private subnets will be used.
*/
public function __construct(
private HttpClientInterface $client,
private string|array|null $subnets = null,
) {
public function __construct(HttpClientInterface $client, string|array|null $subnets = null)
{
if (!class_exists(IpUtils::class)) {
throw new \LogicException(\sprintf('You cannot use "%s" if the HttpFoundation component is not installed. Try running "composer require symfony/http-foundation".', __CLASS__));
}

if (null === $subnets) {
$ipFlags = \FILTER_FLAG_IPV4 | \FILTER_FLAG_IPV6;
} else {
$ipFlags = 0;
foreach ((array) $subnets as $subnet) {
$ipFlags |= str_contains($subnet, ':') ? \FILTER_FLAG_IPV6 : \FILTER_FLAG_IPV4;
}
}

if (!\defined('STREAM_PF_INET6')) {
$ipFlags &= ~\FILTER_FLAG_IPV6;
}

$this->client = $client;
$this->subnets = null !== $subnets ? (array) $subnets : null;
$this->ipFlags = $ipFlags;
$this->dnsCache = new \ArrayObject();
}

public function request(string $method, string $url, array $options = []): ResponseInterface
{
$onProgress = $options['on_progress'] ?? null;
if (null !== $onProgress && !\is_callable($onProgress)) {
throw new InvalidArgumentException(\sprintf('Option "on_progress" must be callable, "%s" given.', get_debug_type($onProgress)));
[$url, $options] = self::prepareRequest($method, $url, $options, $this->defaultOptions, true);

$redirectHeaders = parse_url($url['authority']);
$host = $redirectHeaders['host'];
$url = implode('', $url);
$dnsCache = $this->dnsCache;

$ip = self::dnsResolve($dnsCache, $host, $this->ipFlags, $options);
self::ipCheck($ip, $this->subnets, $this->ipFlags, $host, $url);

if (0 < $maxRedirects = $options['max_redirects']) {
$options['max_redirects'] = 0;
$redirectHeaders['with_auth'] = $redirectHeaders['no_auth'] = $options['headers'];

if (isset($options['normalized_headers']['host']) || isset($options['normalized_headers']['authorization']) || isset($options['normalized_headers']['cookie'])) {
$redirectHeaders['no_auth'] = array_filter($redirectHeaders['no_auth'], static function ($h) {
return 0 !== stripos($h, 'Host:') && 0 !== stripos($h, 'Authorization:') && 0 !== stripos($h, 'Cookie:');
});
}
}

$onProgress = $options['on_progress'] ?? null;
$subnets = $this->subnets;
$ipFlags = $this->ipFlags;

$options['on_progress'] = static function (int $dlNow, int $dlSize, array $info) use ($onProgress, $subnets): void {
static $lastUrl = '';
$options['on_progress'] = static function (int $dlNow, int $dlSize, array $info) use ($onProgress, $subnets, $ipFlags): void {
static $lastPrimaryIp = '';

if ($info['url'] !== $lastUrl) {
$host = parse_url($info['url'], PHP_URL_HOST) ?: '';
$resolve = $info['resolve'] ?? static function () { return null; };
if (($info['primary_ip'] ?? '') !== $lastPrimaryIp) {
self::ipCheck($info['primary_ip'], $subnets, $ipFlags, null, $info['url']);
$lastPrimaryIp = $info['primary_ip'];
}

if (($ip = trim($host, '[]'))
&& !filter_var($ip, \FILTER_VALIDATE_IP)
&& !($ip = $resolve($host))
&& $ip = @(gethostbynamel($host)[0] ?? dns_get_record($host, \DNS_AAAA)[0]['ipv6'] ?? null)
) {
$resolve($host, $ip);
}
null !== $onProgress && $onProgress($dlNow, $dlSize, $info);
};

if ($ip && IpUtils::checkIp($ip, $subnets ?? IpUtils::PRIVATE_SUBNETS)) {
throw new TransportException(sprintf('Host "%s" is blocked for "%s".', $host, $info['url']));
}
return new AsyncResponse($this->client, $method, $url, $options, static function (ChunkInterface $chunk, AsyncContext $context) use (&$method, &$options, $maxRedirects, &$redirectHeaders, $subnets, $ipFlags, $dnsCache): \Generator {
if (null !== $chunk->getError() || $chunk->isTimeout() || !$chunk->isFirst()) {
yield $chunk;

$lastUrl = $info['url'];
return;
}

if ($info['primary_ip'] !== $lastPrimaryIp) {
if ($info['primary_ip'] && IpUtils::checkIp($info['primary_ip'], $subnets ?? IpUtils::PRIVATE_SUBNETS)) {
throw new TransportException(\sprintf('IP "%s" is blocked for "%s".', $info['primary_ip'], $info['url']));
}
$statusCode = $context->getStatusCode();

$lastPrimaryIp = $info['primary_ip'];
if ($statusCode < 300 || 400 <= $statusCode || null === $url = $context->getInfo('redirect_url')) {
$context->passthru();

yield $chunk;

return;
}

null !== $onProgress && $onProgress($dlNow, $dlSize, $info);
};
$host = parse_url($url, \PHP_URL_HOST);
$ip = self::dnsResolve($dnsCache, $host, $ipFlags, $options);
self::ipCheck($ip, $subnets, $ipFlags, $host, $url);

// Do like curl and browsers: turn POST to GET on 301, 302 and 303
if (303 === $statusCode || 'POST' === $method && \in_array($statusCode, [301, 302], true)) {
$method = 'HEAD' === $method ? 'HEAD' : 'GET';
unset($options['body'], $options['json']);

if (isset($options['normalized_headers']['content-length']) || isset($options['normalized_headers']['content-type']) || isset($options['normalized_headers']['transfer-encoding'])) {
$filterContentHeaders = static function ($h) {
return 0 !== stripos($h, 'Content-Length:') && 0 !== stripos($h, 'Content-Type:') && 0 !== stripos($h, 'Transfer-Encoding:');
};
$options['header'] = array_filter($options['header'], $filterContentHeaders);
$redirectHeaders['no_auth'] = array_filter($redirectHeaders['no_auth'], $filterContentHeaders);
$redirectHeaders['with_auth'] = array_filter($redirectHeaders['with_auth'], $filterContentHeaders);
}
}

return $this->client->request($method, $url, $options);
// Authorization and Cookie headers MUST NOT follow except for the initial host name
$port = parse_url($url, \PHP_URL_PORT);
$options['headers'] = $redirectHeaders['host'] === $host && ($redirectHeaders['port'] ?? null) === $port ? $redirectHeaders['with_auth'] : $redirectHeaders['no_auth'];

static $redirectCount = 0;
$context->setInfo('redirect_count', ++$redirectCount);

$context->replaceRequest($method, $url, $options);

if ($redirectCount >= $maxRedirects) {
$context->passthru();
}
});
}

public function stream(ResponseInterface|iterable $responses, ?float $timeout = null): ResponseStreamInterface
Expand All @@ -110,14 +179,73 @@ public function withOptions(array $options): static
{
$clone = clone $this;
$clone->client = $this->client->withOptions($options);
$clone->defaultOptions = self::mergeDefaultOptions($options, $this->defaultOptions);

return $clone;
}

public function reset(): void
{
$this->dnsCache->exchangeArray([]);

if ($this->client instanceof ResetInterface) {
$this->client->reset();
}
}

private static function dnsResolve(\ArrayObject $dnsCache, string $host, int $ipFlags, array &$options): string
{
if ($ip = filter_var(trim($host, '[]'), \FILTER_VALIDATE_IP) ?: $options['resolve'][$host] ?? false) {
return $ip;
}

if ($dnsCache->offsetExists($host)) {
return $dnsCache[$host];
}

if ((\FILTER_FLAG_IPV4 & $ipFlags) && $ip = gethostbynamel($host)) {
return $options['resolve'][$host] = $dnsCache[$host] = $ip[0];
}

if (!(\FILTER_FLAG_IPV6 & $ipFlags)) {
return $host;
}

if ($ip = dns_get_record($host, \DNS_AAAA)) {
$ip = $ip[0]['ipv6'];
} elseif (extension_loaded('sockets')) {
if (!$info = socket_addrinfo_lookup($host, 0, ['ai_socktype' => \SOCK_STREAM, 'ai_family' => \AF_INET6])) {
return $host;
}

$ip = socket_addrinfo_explain($info[0])['ai_addr']['sin6_addr'];
} elseif ('localhost' === $host || 'localhost.' === $host) {
$ip = '::1';
} else {
return $host;
}

return $options['resolve'][$host] = $dnsCache[$host] = $ip;
}

private static function ipCheck(string $ip, ?array $subnets, int $ipFlags, ?string $host, string $url): void
{
if (null === $subnets) {
// Quick check, but not reliable enough, see https://github.com/php/php-src/issues/16944
$ipFlags |= \FILTER_FLAG_NO_PRIV_RANGE | \FILTER_FLAG_NO_RES_RANGE;
}

if (false !== filter_var($ip, \FILTER_VALIDATE_IP, $ipFlags) && !IpUtils::checkIp($ip, $subnets ?? IpUtils::PRIVATE_SUBNETS)) {
return;
}

if (null !== $host) {
$type = 'Host';
} else {
$host = $ip;
$type = 'IP';
}

throw new TransportException($type.\sprintf(' "%s" is blocked for "%s".', $host, $url));
}
}
10 changes: 1 addition & 9 deletions Response/AmpResponseV4.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,17 +90,9 @@ public function __construct(
$info['max_duration'] = $options['max_duration'];
$info['debug'] = '';

$resolve = static function (string $host, ?string $ip = null) use ($multi): ?string {
if (null !== $ip) {
$multi->dnsCache[$host] = $ip;
}

return $multi->dnsCache[$host] ?? null;
};
$onProgress = $options['on_progress'] ?? static function () {};
$onProgress = $this->onProgress = static function () use (&$info, $onProgress, $resolve) {
$onProgress = $this->onProgress = static function () use (&$info, $onProgress) {
$info['total_time'] = microtime(true) - $info['start_time'];
$info['resolve'] = $resolve;
$onProgress((int) $info['size_download'], ((int) (1 + $info['download_content_length']) ?: 1) - 1, (array) $info);
};

Expand Down
10 changes: 1 addition & 9 deletions Response/AmpResponseV5.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -89,17 +89,9 @@ public function __construct(
$info['max_duration'] = $options['max_duration'];
$info['debug'] = '';

$resolve = static function (string $host, ?string $ip = null) use ($multi): ?string {
if (null !== $ip) {
$multi->dnsCache[$host] = $ip;
}

return $multi->dnsCache[$host] ?? null;
};
$onProgress = $options['on_progress'] ?? static function () {};
$onProgress = $this->onProgress = static function () use (&$info, $onProgress, $resolve) {
$onProgress = $this->onProgress = static function () use (&$info, $onProgress) {
$info['total_time'] = microtime(true) - $info['start_time'];
$info['resolve'] = $resolve;
$onProgress((int) $info['size_download'], ((int) (1 + $info['download_content_length']) ?: 1) - 1, (array) $info);
};

Expand Down
11 changes: 2 additions & 9 deletions Response/CurlResponse.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -122,20 +122,13 @@ public function __construct(
curl_pause($ch, \CURLPAUSE_CONT);

if ($onProgress = $options['on_progress']) {
$resolve = static function (string $host, ?string $ip = null) use ($multi): ?string {
if (null !== $ip) {
$multi->dnsCache->hostnames[$host] = $ip;
}

return $multi->dnsCache->hostnames[$host] ?? null;
};
$url = isset($info['url']) ? ['url' => $info['url']] : [];
curl_setopt($ch, \CURLOPT_NOPROGRESS, false);
curl_setopt($ch, \CURLOPT_PROGRESSFUNCTION, static function ($ch, $dlSize, $dlNow) use ($onProgress, &$info, $url, $multi, $debugBuffer, $resolve) {
curl_setopt($ch, \CURLOPT_PROGRESSFUNCTION, static function ($ch, $dlSize, $dlNow) use ($onProgress, &$info, $url, $multi, $debugBuffer) {
try {
rewind($debugBuffer);
$debug = ['debug' => stream_get_contents($debugBuffer)];
$onProgress($dlNow, $dlSize, $url + curl_getinfo($ch) + $info + $debug + ['resolve' => $resolve]);
$onProgress($dlNow, $dlSize, $url + curl_getinfo($ch) + $info + $debug);
} catch (\Throwable $e) {
$multi->handlesActivity[(int) $ch][] = null;
$multi->handlesActivity[(int) $ch][] = $e;
Expand Down
3 changes: 3 additions & 0 deletions Tests/AmpHttpClientTest.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@
use Symfony\Component\HttpClient\AmpHttpClient;
use Symfony\Contracts\HttpClient\HttpClientInterface;

/**
* @group dns-sensitive
*/
class AmpHttpClientTest extends HttpClientTestCase
{
protected function getHttpClient(string $testCase): HttpClientInterface
Expand Down
1 change: 1 addition & 0 deletions Tests/CurlHttpClientTest.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@

/**
* @requires extension curl
* @group dns-sensitive
*/
class CurlHttpClientTest extends HttpClientTestCase
{
Expand Down
Loading

0 comments on commit e961ee6

Please sign in to comment.