mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-16 22:05:20 +00:00
99ea898e88
v3 port. The Gotenberg PDF driver was missed when the SSRF guards were added to the AI, exchange-rate and file-disk drivers: gotenberg_host was validated only with 'url', and the driver POSTs the rendered HTML to it. Reuses the existing infrastructure (consistency with the other drivers): - Wires App\Rules\PublicHttpUrl into the gotenberg_host validation rule. - Adds PrivateNetworkGuard::assertAllowed() in GotenbergPdfDriver before the outbound call (covers env/seed/stale config + DNS rebinding). Adds a unit test asserting the gotenberg_host rule rejects private/loopback/ link-local addresses and allows a public one.
26 lines
929 B
PHP
26 lines
929 B
PHP
<?php
|
|
|
|
use App\Http\Requests\PDFConfigurationRequest;
|
|
use Illuminate\Support\Facades\Validator;
|
|
|
|
test('gotenberg host rejects private, loopback and link-local addresses', function (string $url) {
|
|
$rules = PDFConfigurationRequest::create('/', 'POST', ['pdf_driver' => 'gotenberg'])->rules();
|
|
|
|
$validator = Validator::make(['gotenberg_host' => $url], ['gotenberg_host' => $rules['gotenberg_host']]);
|
|
|
|
expect($validator->fails())->toBeTrue();
|
|
})->with([
|
|
'http://127.0.0.1',
|
|
'http://169.254.169.254',
|
|
'http://10.0.0.5',
|
|
'http://192.168.1.1',
|
|
]);
|
|
|
|
test('gotenberg host allows a public address', function () {
|
|
$rules = PDFConfigurationRequest::create('/', 'POST', ['pdf_driver' => 'gotenberg'])->rules();
|
|
|
|
$validator = Validator::make(['gotenberg_host' => 'http://8.8.8.8'], ['gotenberg_host' => $rules['gotenberg_host']]);
|
|
|
|
expect($validator->errors()->has('gotenberg_host'))->toBeFalse();
|
|
});
|