WebSVN – Moodle – Diff – /lib/classes/files/curl_security_helper.php

         'http' => 80,
         'https' => 443
     ];
+    /**
+     * @var string the host of the URL being checked by the helper.
+     */
+    protected $host;
+    /**
+     * @var array IP address or addresses the URL is allowed to be requested from (passed the blocked hosts check).
+     */
+    protected $allowedips = [];
+    /**
+     * @var ?int The port the URL is allowed to be requested from (passed the allowed port check).
+     */
+    protected $allowedport;
     /**
      * Checks whether the given URL is blocked by checking its address and port number against the allow/block lists.
      * The behaviour of this function can be classified as strict, as it returns true for URLs which are invalid or
      * could not be parsed, as well as those valid URLs which were found in the blocklist.
+     *
         } catch (\moodle_exception $e) {
             // Moodle exception is thrown if the $urlstring is invalid. Treat as blocked.
             return true;
+        }
+        $this->host = $parsed['host'];
         // The port will be empty unless explicitly set in the $url (uncommon), so try to infer it from the supported schemes.
         if (!$parsed['port'] && $parsed['scheme'] && isset($this->transportschemes[$parsed['scheme']])) {
             $parsed['port'] = $this->transportschemes[$parsed['scheme']];
                 // If we don't get a valid record, bail (so cURL is never called).
                 if (!$hostips) {
                     return true;
+                }
+                // If any of the returned IPs are in the blocklist, block the request. Otherwise, temporarily record the IPs.
-                // If any of the returned IPs are in the blocklist, block the request.
+                $allowedips = [];
                 foreach ($hostips as $hostip) {
                     if ($this->address_explicitly_blocked($hostip)) {
                         return true;
+                    }
                     $allowedips[] = $hostip;
+                }
+                // If none of the IPs are blocked, set them on the allow list so we can enforce them on subsequent requests.
                 $this->allowedips = $allowedips;
+            }
         } else {
             // Was not something we consider to be a valid IP or domain name, block it.
             return true;
         // Intentionally block port 0 and below and check the int cast was valid.
         if (empty($port) || (string)$portnum !== (string)$port || $port < 0) {
             return true;
+        }
         $allowedports = $this->get_allowed_ports();
-        return !empty($allowedports) && !in_array($portnum, $allowedports);
+        $isblocked = !empty($allowedports) && !in_array($portnum, $allowedports);
+        // If port is allowed, add it to our allow list so we can enforce it on subsequent requests.
+        if (!$isblocked) {
+            $this->allowedport = $portnum;
+        }
+        return $isblocked;
+    }
     /**
      * Convenience method to check whether we have any entries in the host blocklist or ports allowlist admin settings.
+        }
         return array_filter(array_map('trim', explode("\n", $CFG->curlsecurityblockedhosts)), function($entry) {
             return !empty($entry);
         });
+    }
+    /**
+     * Helper that returns host, IP and port information for the URL that has passed the blocked hosts/allowed ports checks.
+     *
+     * This data is in a format compatible with CURLOPT_RESOLVE, so it can be passed directly into that option.
+     * Doing so will prevent cURL re-fetching the info from DNS, preventing subsequent requests to the remote host from
+     * modifying the IP/port to ones that haven't been validated.
+     *
+     * @return array of strings in the format hostname:port:ip_address.
+     * @throws \coding_exception
+     */
+    public function get_resolve_info(): array {
+        if (empty($this->host || empty($this->allowedips) || empty($this->allowedport))) {
+            $exception = 'In the curl_security_helper class, url_is_blocked() must be called before get_resolve_info() is called.';
+            throw new \core\exception\coding_exception($exception);
+        }
+        return array_map(fn($ip) => "$this->host:$this->allowedport:$ip", $this->allowedips);
+    }
+}

Proyectos de Subversion Moodle

(root)/lib/classes/files/curl_security_helper.php – Rev 1 → 1441