Backport of InvoiceShelf/InvoiceShelf#691 to 2.x, for the reporter of
#688 who is on 2.4.1.
The guard added in the 2.4.0 security round rejects private addresses,
which includes the shipped default host `http://pdf:3000` and every
Docker Compose sidecar deployment. So the guard rejects its own default
and Gotenberg cannot be configured at all on the standard setup — a
usability regression introduced by a security patch, which is why this
lands during the 2.x feature freeze.
GOTENBERG_ALLOWED_PRIVATE_HOST names the single host that may skip the
check. It is deliberately not a boolean and not settable from the admin
UI: the driver streams the upstream response body back as the PDF, so a
blanket "allow private" switch would let gotenberg_host be repointed at
a link-local metadata endpoint and the response read back. Naming one
host keeps the sidecar working while every other private target stays
blocked.
GotenbergHostPolicy owns the comparison so the save-time rule and the
runtime driver guard cannot drift, normalising case, trailing slash and
surrounding whitespace on both sides.
Note this differs from 3.x in one respect: SafeRemoteUrl rejects hosts
that do not resolve, where 3.x's PrivateNetworkGuard lets them through.
That behaviour is unchanged here — a typo'd host is still refused at save
time on 2.x, which is the friendlier outcome.
gotenberg_host was validated only with Laravel's 'url' rule, which permits
loopback/private/link-local hosts (e.g. http://127.0.0.1, http://10.0.0.1,
the cloud metadata endpoint http://169.254.169.254). When a PDF renders, the
server POSTs the document HTML to that host — an SSRF primitive.
- Adds App\Rules\SafeRemoteUrl: requires http(s) and rejects any host that
resolves to a loopback/private/link-local/CGNAT/reserved address (IPv4 and
IPv6), including literal-IP hosts.
- Wires it into PDFConfigurationRequest for gotenberg_host.
- Adds a defensive re-check in GotenbergPDFDriver before the outbound call to
cover hosts set via env/seed/stale config or DNS rebinding (TOCTOU).
Adds unit tests for the rule + validator integration.
Darko Gjorgjijoski