mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-09-06 15:14:13 +00:00
Darko Gjorgjijoski
4d6ece6230
Backport of InvoiceShelf/InvoiceShelf#691 to 2.x, for the reporter of #688 who is on 2.4.1. The guard added in the 2.4.0 security round rejects private addresses, which includes the shipped default host `http://pdf:3000` and every Docker Compose sidecar deployment. So the guard rejects its own default and Gotenberg cannot be configured at all on the standard setup — a usability regression introduced by a security patch, which is why this lands during the 2.x feature freeze. GOTENBERG_ALLOWED_PRIVATE_HOST names the single host that may skip the check. It is deliberately not a boolean and not settable from the admin UI: the driver streams the upstream response body back as the PDF, so a blanket "allow private" switch would let gotenberg_host be repointed at a link-local metadata endpoint and the response read back. Naming one host keeps the sidecar working while every other private target stays blocked. GotenbergHostPolicy owns the comparison so the save-time rule and the runtime driver guard cannot drift, normalising case, trailing slash and surrounding whitespace on both sides. Note this differs from 3.x in one respect: SafeRemoteUrl rejects hosts that do not resolve, where 3.x's PrivateNetworkGuard lets them through. That behaviour is unchanged here — a typo'd host is still refused at save time on 2.x, which is the friendlier outcome.
102 lines
3.7 KiB
PHP
102 lines
3.7 KiB
PHP
<?php
|
|
|
|
use App\Http\Requests\PDFConfigurationRequest;
|
|
use App\Services\PDFDrivers\GotenbergPDFDriver;
|
|
use App\Support\GotenbergHostPolicy;
|
|
use Illuminate\Support\Facades\Validator;
|
|
|
|
/**
|
|
* Build the gotenberg_host rules the way the form request would for a given
|
|
* submitted host, then validate that host against them.
|
|
*/
|
|
function validateGotenbergHost(string $url): Illuminate\Validation\Validator
|
|
{
|
|
$rules = PDFConfigurationRequest::create('/', 'POST', [
|
|
'pdf_driver' => 'gotenberg',
|
|
'gotenberg_host' => $url,
|
|
])->rules();
|
|
|
|
return Validator::make(['gotenberg_host' => $url], ['gotenberg_host' => $rules['gotenberg_host']]);
|
|
}
|
|
|
|
test('a private gotenberg host is rejected when nothing is declared', function (string $url) {
|
|
config(['pdf.connections.gotenberg.allowed_private_host' => null]);
|
|
|
|
expect(validateGotenbergHost($url)->fails())->toBeTrue();
|
|
})->with([
|
|
'http://127.0.0.1:3000',
|
|
'http://169.254.169.254',
|
|
'http://10.0.0.5:3000',
|
|
'http://192.168.1.1:3000',
|
|
]);
|
|
|
|
test('the private host declared in the environment is accepted', function () {
|
|
config(['pdf.connections.gotenberg.allowed_private_host' => 'http://10.0.0.5:3000']);
|
|
|
|
expect(validateGotenbergHost('http://10.0.0.5:3000')->errors()->has('gotenberg_host'))->toBeFalse();
|
|
});
|
|
|
|
/**
|
|
* The point of naming the host rather than flipping a boolean: declaring one
|
|
* private host must not open the guard for any other. Without this, an operator
|
|
* who enables the sidecar also hands an admin the ability to repoint the setting
|
|
* at a cloud metadata endpoint and read the response back as a "PDF".
|
|
*/
|
|
test('declaring one private host does not exempt any other', function (string $url) {
|
|
config(['pdf.connections.gotenberg.allowed_private_host' => 'http://pdf:3000']);
|
|
|
|
expect(validateGotenbergHost($url)->fails())->toBeTrue();
|
|
})->with([
|
|
'http://169.254.169.254',
|
|
'http://127.0.0.1:3000',
|
|
'http://10.0.0.5:3000',
|
|
]);
|
|
|
|
test('the declared host is matched ignoring case and trailing slash', function (string $configured, string $submitted) {
|
|
config(['pdf.connections.gotenberg.allowed_private_host' => $configured]);
|
|
|
|
expect(GotenbergHostPolicy::isExemptFromSafeRemoteUrl($submitted))->toBeTrue();
|
|
})->with([
|
|
['http://pdf:3000', 'http://pdf:3000/'],
|
|
['http://pdf:3000/', 'http://pdf:3000'],
|
|
['HTTP://PDF:3000', 'http://pdf:3000'],
|
|
[' http://pdf:3000 ', 'http://pdf:3000'],
|
|
]);
|
|
|
|
test('the policy rejects hosts that differ in any meaningful part', function (string $submitted) {
|
|
config(['pdf.connections.gotenberg.allowed_private_host' => 'http://pdf:3000']);
|
|
|
|
expect(GotenbergHostPolicy::isExemptFromSafeRemoteUrl($submitted))->toBeFalse();
|
|
})->with([
|
|
'http://pdf:3001',
|
|
'https://pdf:3000',
|
|
'http://pdf',
|
|
'http://other:3000',
|
|
'http://pdf:3000/render',
|
|
'not a url',
|
|
'',
|
|
]);
|
|
|
|
test('an unset allowlist exempts nothing', function () {
|
|
config(['pdf.connections.gotenberg.allowed_private_host' => null]);
|
|
|
|
expect(GotenbergHostPolicy::isExemptFromSafeRemoteUrl('http://pdf:3000'))->toBeFalse();
|
|
});
|
|
|
|
/**
|
|
* The driver guard is the authoritative layer — it re-checks at render time, so
|
|
* it has to agree with the validation rule. Asserted on the blocking path only:
|
|
* it throws before any HTTP call is attempted, so the test never touches the
|
|
* network.
|
|
*/
|
|
test('the driver still blocks a private host that was not declared', function () {
|
|
config([
|
|
'pdf.connections.gotenberg.host' => 'http://169.254.169.254',
|
|
'pdf.connections.gotenberg.papersize' => '210mm 297mm',
|
|
'pdf.connections.gotenberg.allowed_private_host' => 'http://pdf:3000',
|
|
]);
|
|
|
|
expect(fn () => (new GotenbergPDFDriver)->loadView('app.pdf.invoice.invoice1'))
|
|
->toThrow(RuntimeException::class, 'unsafe Gotenberg host');
|
|
});
|