Download the PHP package b2bcenter/safecurl without Composer
On this page you can find all versions of the php package b2bcenter/safecurl. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package safecurl
SafeCurl
SafeCurl intends to be a drop-in replacement for the curl_exec function in PHP. SafeCurl validates each part of the URL against a white or black list, to help protect against Server-Side Request Forgery attacks.
For more infomation about the project see the blog post 'SafeCurl: SSRF Protection, and a "Capture the Bitcoins"'.
Protections
Each part of the URL is broken down and validated against a white or black list. This includes resolve a domain name to it's IP addresses.
If you chose to enable "FOLLOWLOCATION", then any redirects are caught, and re-validated.
Installation
SafeCurl can be included in any PHP project using Composer. Include the following in your composer.json file under require.
Then update Composer.
Usage
It's as easy as replacing curl_exec with SafeCurl::execute, and wrapping it in a try {} catch {} block.
Options
The default options are to not allow access to any private IP addresses, and to only allow HTTP(S) connections.
If you wish to add your own options (such as to blacklist any requests to domains your control), simply get a new SimpleCurl\Options object, add to the white or black lists, and pass it along with the method calls.
Domains are express using regex syntax, whilst IPs, scheme and ports are standard strings (IPs can be specified in CIDR notation).
Since we can't get access to any already set cURL options (see Caveats section), to enable CURL_FOLLOWREDIRECTS you must call the enableFollowRedirects() method. If you wish to specify a redirect limit, you will need to call setMaxRedirects(). Passing in 0 will allow infinite redirects.
URL Checking
The URL checking methods are also public, meaning that you can validate a URL before using it elsewhere in your application, although you'd want to try and catch any redirects.
Optional Protections
In addition to the standard checks, two more are available.
The first is to prevent DNS Rebinding attacks. This can be enabled by calling the enablePinDns method on an Options object. There is one major issue with this - the SSL certificate can't be validated. This is due to the real hostname being sent in the Host header, and the URL using the IP address.
The second disables the use of credentials in a URL, since PHP's parse_url returns values which differ from ones cURL uses. This is a temporary fix.
Cavets
Since SafeCurl uses getaddrbyhostl to resolve domain names, which isn't IPv6 compatible, the class will only work with IPv4 at the moment. See Issue #1.
As mentioned above, we can't fetch the value of any cURL options set against the provided cURL handle. Because SafeCurl handles redirects itself, it will turn off CURLOPT_FOLLOWLOCATION and use the value from the Options object. This is also true of CURLOPT_MAXREDIRECTS.
Demo
A live demo is available at http://safecurl.fin1te.net/#demo. For the site source code (if you're curious), it's hosted at fin1te/safecurl.fin1te.net.
Bounty
In order to help make SafeCurl secure and ready for production use, a Bitcoin bounty has been setup.
Inside the document root is a Bitcoin wallet, which is only accessible by 127.0.0.1. If you can bypass the protections and grab the file, you're free to take the Bitcoins.
