mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-05-18 13:24:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

Restrict allowed curl parameters (#7979)

Browse Source 
For additional safety, also making sure in this PR that [`CURLOPT_COOKIEFILE`](https://curl.se/libcurl/c/CURLOPT_COOKIEFILE.html) is only allowed as an empty string during import.
This commit is contained in:
Inverle
2025-09-18 23:43:04 +02:00
committed by GitHub
parent b5ee1d8936
commit 055342118f
2 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/Services/ImportService.php
View File

@@ -275,7 +275,8 @@ class FreshRSS_Import_Service {
$curl_params[CURLOPT_COOKIE] = $feed_elt['frss:CURLOPT_COOKIE'];
}
if (isset($feed_elt['frss:CURLOPT_COOKIEFILE'])) {
$curl_params[CURLOPT_COOKIEFILE] = $feed_elt['frss:CURLOPT_COOKIEFILE'];
// Allow only an empty value just to enable the libcurl cookie engine
$curl_params[CURLOPT_COOKIEFILE] = '';
}
if (isset($feed_elt['frss:CURLOPT_FOLLOWLOCATION'])) {
$curl_params[CURLOPT_FOLLOWLOCATION] = (bool)$feed_elt['frss:CURLOPT_FOLLOWLOCATION'];

19
lib/lib_rss.php
View File

@@ -319,8 +319,27 @@ function customSimplePie(array $attributes = [], array $curl_options = []): \Sim
}
}
if (!empty($attributes['curl_params']) && is_array($attributes['curl_params'])) {
$safe_params = [
CURLOPT_COOKIE,
CURLOPT_COOKIEFILE,
CURLOPT_FOLLOWLOCATION,
CURLOPT_HTTPHEADER,
CURLOPT_MAXREDIRS,
CURLOPT_POST,
CURLOPT_POSTFIELDS,
CURLOPT_PROXY,
CURLOPT_PROXYTYPE,
CURLOPT_USERAGENT,
];
foreach ($attributes['curl_params'] as $co => $v) {
if (is_int($co)) {
if (!in_array($co, $safe_params, true)) {
continue;
}
if ($co === CURLOPT_COOKIEFILE) {
// Allow only an empty value just to enable the libcurl cookie engine
$v = '';
}
$curl_options[$co] = $v;
}
}