Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-11-03 19:08:50 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Also check domainname for valid ip address

Browse source
This commit is contained in:
djmaze 2026-10-26 00:23:08 +01:00
parent 7831b84cc4
commit c9a5348193
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
View file

@ -279,10 +279,18 @@ class ServiceActions
// https://github.com/the-djmaze/snappymail/security/advisories/GHSA-xpr6-5vj6-wq26
private static function allowedProxyUri($uri) : bool
{
if (!\preg_match('#^https?://([^/:]+)#i', $uri, $m)) {
if (!\preg_match('#^https?://#i', $uri)) {
return false;
}
$host = $m[1];
$host = \parse_url($uri, \PHP_URL_HOST);
if (!\is_string($host) || '' === $host) {
return null;
}
// Bracketed IPv6 literals (http://[::1]/): parse_url keeps the
// brackets, which filter_var rejects, so strip them first.
if (\str_starts_with($host, '[') && \str_ends_with($host, ']')) {
$host = \substr($host, 1, -1);
}
// Validate direct IP or resolve hostname
$ips = \filter_var($host, \FILTER_VALIDATE_IP) ? [$host] : \gethostbynamel($host);
if (!$ips || !\is_array($ips)) {