Files
InvoiceShelf/app/Http/Requests/PDFConfigurationRequest.php
Darko Gjorgjijoski 99ea898e88 fix(security): block SSRF via the Gotenberg host setting (GHSA-mfxg) (#671)
v3 port. The Gotenberg PDF driver was missed when the SSRF guards were added
to the AI, exchange-rate and file-disk drivers: gotenberg_host was validated
only with 'url', and the driver POSTs the rendered HTML to it.

Reuses the existing infrastructure (consistency with the other drivers):
- Wires App\Rules\PublicHttpUrl into the gotenberg_host validation rule.
- Adds PrivateNetworkGuard::assertAllowed() in GotenbergPdfDriver before the
  outbound call (covers env/seed/stale config + DNS rebinding).

Adds a unit test asserting the gotenberg_host rule rejects private/loopback/
link-local addresses and allows a public one.
2026-06-12 11:02:19 +02:00

69 lines
1.9 KiB
PHP

<?php
namespace App\Http\Requests;
use App\Rules\PublicHttpUrl;
use Illuminate\Foundation\Http\FormRequest;
class PDFConfigurationRequest extends FormRequest
{
/**
* Determine if the user is authorized to make this request.
*/
public function authorize(): bool
{
return true;
}
/**
* Get the validation rules that apply to the request.
*/
public function rules(): array
{
switch ($this->get('pdf_driver')) {
case 'dompdf':
return [
'pdf_driver' => [
'required',
'string',
],
];
case 'gotenberg':
return [
'pdf_driver' => [
'required',
'string',
],
'gotenberg_host' => [
'required',
'url',
new PublicHttpUrl,
],
'gotenberg_papersize' => [
'required',
'string',
function ($attribute, $value, $fail) {
$reg = "/^\d+(pt|px|pc|mm|cm|in) \d+(pt|px|pc|mm|cm|in)$/";
if (! preg_match($reg, $value)) {
$fail('Invalid papersize, must be in format "210mm 297mm". Accepts: pt,px,pc,mm,cm,in');
}
},
],
'gotenberg_margins' => [
'nullable',
'string',
],
];
default:
return [
'pdf_driver' => [
'required',
'string',
],
];
}
}
}