mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-16 22:05:20 +00:00
gotenberg_host was validated only with Laravel's 'url' rule, which permits loopback/private/link-local hosts (e.g. http://127.0.0.1, http://10.0.0.1, the cloud metadata endpoint http://169.254.169.254). When a PDF renders, the server POSTs the document HTML to that host — an SSRF primitive. - Adds App\Rules\SafeRemoteUrl: requires http(s) and rejects any host that resolves to a loopback/private/link-local/CGNAT/reserved address (IPv4 and IPv6), including literal-IP hosts. - Wires it into PDFConfigurationRequest for gotenberg_host. - Adds a defensive re-check in GotenbergPDFDriver before the outbound call to cover hosts set via env/seed/stale config or DNS rebinding (TOCTOU). Adds unit tests for the rule + validator integration.
69 lines
1.9 KiB
PHP
69 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Requests;
|
|
|
|
use App\Rules\SafeRemoteUrl;
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
|
|
class PDFConfigurationRequest extends FormRequest
|
|
{
|
|
/**
|
|
* Determine if the user is authorized to make this request.
|
|
*/
|
|
public function authorize(): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Get the validation rules that apply to the request.
|
|
*/
|
|
public function rules(): array
|
|
{
|
|
switch ($this->get('pdf_driver')) {
|
|
case 'dompdf':
|
|
return [
|
|
'pdf_driver' => [
|
|
'required',
|
|
'string',
|
|
],
|
|
];
|
|
|
|
case 'gotenberg':
|
|
return [
|
|
'pdf_driver' => [
|
|
'required',
|
|
'string',
|
|
],
|
|
'gotenberg_host' => [
|
|
'required',
|
|
'url',
|
|
new SafeRemoteUrl,
|
|
],
|
|
'gotenberg_papersize' => [
|
|
'required',
|
|
'string',
|
|
function ($attribute, $value, $fail) {
|
|
$reg = "/^\d+(pt|px|pc|mm|cm|in) \d+(pt|px|pc|mm|cm|in)$/";
|
|
if (! preg_match($reg, $value)) {
|
|
$fail('Invalid papersize, must be in format "210mm 297mm". Accepts: pt,px,pc,mm,cm,in');
|
|
}
|
|
},
|
|
],
|
|
'gotenberg_margins' => [
|
|
'nullable',
|
|
'string',
|
|
],
|
|
];
|
|
|
|
default:
|
|
return [
|
|
'pdf_driver' => [
|
|
'required',
|
|
'string',
|
|
],
|
|
];
|
|
}
|
|
}
|
|
}
|