PHP code example of cboxdk / laravel-ssrf

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

cboxdk / laravel-ssrf example snippets

use Illuminate\Support\Facades\Http;

// Validates the URL, pins the connection to the resolved public IPs, and
// refuses to follow redirects — then behaves like the normal HTTP client.
$response = Http::ssrf()->post($url, $payload);

Http::ssrf()->get($url);          // GET, pinned + no-redirect
Http::ssrf()->post($url, $data);  // throws Cbox\Ssrf\Exceptions\BlockedUrl if unsafe

$client = Http::ssrf();

foreach ($endpoints as $endpoint) {
    $client->post($endpoint, $payload);  // each URL guarded and pinned on its own
}

Http::ssrf($url)->post($url, $data);  // throws here if $url is unsafe

use Cbox\Ssrf\Rules\PublicUrl;

$request->validate([
    'webhook_url' => ['

use Cbox\Ssrf\Contracts\UrlGuard;

$guard = app(UrlGuard::class);

$guard->assertSafe($url);        // throws BlockedUrl on failure
$guard->isSafe($url);            // bool
$guard->pinnedOptions($url);     // Guzzle options for your own client call

// Webhook sink: HTTPS only, no credentials (the default).
$guard->assertSafe($webhookUrl, ['https']);

// Git sink: HTTPS or SSH, and a deploy token in the URL is allowed.
$guard->assertSafe($repoUrl, ['https', 'ssh'], allowCredentials: true);
Http::ssrf(allowedSchemes: ['https', 'ssh'], allowCredentials: true)->get($repoUrl);

// Same overrides on the validation rule, per field:
$request->validate([
    'repo_url' => ['

$guard->assertSafeRedirect($authorizeUrl);

use Cbox\Ssrf\Contracts\Resolver;
use Cbox\Ssrf\Testing\FakeResolver;

$this->app->instance(Resolver::class, new FakeResolver([
    'evil.test' => ['169.254.169.254'],
]));

bash
php artisan vendor:publish --tag=ssrf-config