Changeset 3269:da4849c1ad84 for plugins/importExport/inc/class.dc.import.feed.php

Timestamp:

07/17/16 10:09:33 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Prevents SSRF/XSPA on Feed import, thanks wiswat for reporting this.

File:

• plugins/importExport/inc/class.dc.import.feed.php (modified) (2 diffs)

plugins/importExport/inc/class.dc.import.feed.php

@@ -16 +16 @@
      protected $status = false;
      protected $feed_url = '';
+
+     // IPv6 functions (from https://gist.github.com/tbaschak/7866688)
+     private function gethostbyname6($host,$try_a = false) {
+        // get AAAA record for $host
+        // if $try_a is true, if AAAA fails, it tries for A
+        // the first match found is returned
+        // otherwise returns false
+
+        $dns = $this->gethostbynamel6($host,$try_a);
+        if ($dns == false) {
+          return false;
+        }
+        else {
+          return $dns[0];
+        }
+    }
+    private function gethostbynamel6($host,$try_a = false) {
+        // get AAAA records for $host,
+        // if $try_a is true, if AAAA fails, it tries for A
+        // results are returned in an array of ips found matching type
+        // otherwise returns false
+
+        $dns6 = dns_get_record($host,DNS_AAAA);
+        if ($try_a == true) {
+            $dns4 = dns_get_record($host,DNS_A);
+            $dns = array_merge($dns4,$dns6);
+        }
+        else {
+          $dns = $dns6;
+        }
+        $ip6 = array();
+        $ip4 = array();
+        foreach ($dns as $record) {
+            if ($record["type"] == "A") {
+                $ip4[] = $record["ip"];
+            }
+            if ($record["type"] == "AAAA") {
+                $ip6[] = $record["ipv6"];
+            }
+        }
+        if (count($ip6) < 1) {
+            if ($try_a == true) {
+                if (count($ip4) < 1) {
+                    return false;
+                }
+                else {
+                    return $ip4;
+                }
+            }
+            else {
+                return false;
+            }
+        }
+        else {
+            return $ip6;
+        }
+    }
 
      public function setInfo()
@@ -36 +93 @@
 
           $this->feed_url = $_POST['feed_url'];
+
+          // Check feed URL
+          if ($this->core->blog->settings->system->import_feed_url_control) {
+               // Get IP from URL
+               $bits = parse_url($this->feed_url);
+               if (!$bits || !isset($bits['host'])) {
+                    throw new Exception(__('Cannot retrieve feed URL.'));
+               }
+               $ip = gethostbyname($bits['host']);
+               if ($ip == $bits['host']) {
+                    $ip = $this->gethostbyname6($bits['host']);
+                    if (!$ip) {
+                         throw new Exception(__('Cannot retrieve feed URL.'));
+                    }
+               }
+               // Check feed IP
+               $flag = FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6;
+               if ($this->core->blog->settings->system->import_feed_no_private_ip) {
+                    $flag |= FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE;
+               }
+               if (!filter_var($ip,$flag)) {
+                    throw new Exception(__('Cannot retrieve feed URL.'));
+               }
+               // IP control (white list regexp)
+               if ($this->core->blog->settings->system->import_feed_ip_regexp != '') {
+                    if (!preg_match($this->core->blog->settings->system->import_feed_ip_regexp,$ip)) {
+                         throw new Exception(__('Cannot retrieve feed URL.'));
+                    }
+               }
+               // Port control (white list regexp)
+               if ($this->core->blog->settings->system->import_feed_port_regexp != '' && isset($bits['port'])) {
+                    if (!preg_match($this->core->blog->settings->system->import_feed_port_regexp,$bits['port'])) {
+                         throw new Exception(__('Cannot retrieve feed URL.'));
+                    }
+               }
+          }
 
           $feed = feedReader::quickParse($this->feed_url);