mirror of
https://github.com/the-djmaze/snappymail.git
synced 2026-11-03 19:08:50 +03:00
650133ae8a
URIHasPublicHost() relied on FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE alone. On PHP 8.4 that passes 100.64.0.0/10 (shared space: CGNAT, Tailscale, Alibaba metadata at 100.100.100.200), 192.0.0.0/24, 198.18.0.0/15, 224.0.0.0/4, fec0::/10 and ff00::/8. It also passed the server's own public addresses: a fetch to them never leaves the host, so it reaches services that listen on every address but are firewalled from outside (on our host: grafana, forgejo, prometheus and the exporters). Both checks, on the literal host and on every resolved address, now go through IsPublicIP(): PHP's flags, then an explicit list of the ranges above, then the addresses net_get_interfaces() reports for this host (cached per request). test/ssrf-ranges.php checks the new ranges and their edges, that ordinary public addresses still pass, and the own-address rule via the cache. Before this change 100.64.0.1 was treated as public. DNS rebinding between check and connect is still not covered; that needs the connection pinned to the checked address. |
||
|---|---|---|
| .. | ||
| carddav.php | ||
| crypt-forgery.php | ||
| header-injection.php | ||
| raw-inline-type.php | ||
| sasl.php | ||
| smime-verify.php | ||
| sso.php | ||
| ssrf-ranges.php | ||