Download the PHP package j0k3r/httplug-ssrf-plugin without Composer

On this page you can find all versions of the php package j0k3r/httplug-ssrf-plugin. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package httplug-ssrf-plugin

Server-Side Request Forgery (SSRF) protection plugin for HTTPlug

CI Coverage Status

Inspired from SafeCurl, it intends to validate each part of the URL against a white or black list, to help protect against Server-Side Request Forgery attacks when using HTTPlug.

Each part of the URL is broken down and validated against a white or black list. This includes resolve a domain name to it's IP addresses.

Installation

It can be included in any PHP project using Composer.

Usage

The plugin throws a Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Exception\InvalidURLException if the url is not valid.

Options

The default options are to not allow access to any private IP addresses, and to only allow HTTP(S) connections.

If you wish to add your own options (such as to blacklist any requests to domains your control), simply get a new Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Options object, add to the white or black lists, and pass it along with the method calls.

Domains are express using regex syntax, whilst IPs, scheme and ports are standard strings (IPs can be specified in CIDR notation).

Optional Protections

In addition to the standard checks, two more are available.

The first is to prevent DNS Rebinding attacks. This can be enabled by calling the enablePinDns method on an Options object. There is one major issue with this - the SSL certificate can't be validated. This is due to the real hostname being sent in the Host header, and the URL using the IP address.

The second disables the use of credentials in a URL, since PHP's parse_url returns values which differ from ones cURL uses. This is a temporary fix.

Cavets

Since the libray uses gethostbynamel to resolve domain names, which isn't IPv6 compatible, the class will only work with IPv4 at the moment.


All versions of httplug-ssrf-plugin with dependencies

PHP Build Version
Package Version
Requires php Version >=7.4
php-http/client-common Version ^2.6
php-http/discovery Version ^1.15
php-http/message Version ^1.13
psr/http-factory Version ^1.0
psr/http-message Version ^1.0 || ^2.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package j0k3r/httplug-ssrf-plugin contains the following files

Loading the files please wait ....