Files
InvoiceShelf/app/Http/Requests/PDFConfigurationRequest.php
Darko Gjorgjijoski d615cfb4ff fix(security): block SSRF via the Gotenberg host setting (GHSA-mfxg) (#664)
gotenberg_host was validated only with Laravel's 'url' rule, which permits
loopback/private/link-local hosts (e.g. http://127.0.0.1, http://10.0.0.1,
the cloud metadata endpoint http://169.254.169.254). When a PDF renders, the
server POSTs the document HTML to that host — an SSRF primitive.

- Adds App\Rules\SafeRemoteUrl: requires http(s) and rejects any host that
  resolves to a loopback/private/link-local/CGNAT/reserved address (IPv4 and
  IPv6), including literal-IP hosts.
- Wires it into PDFConfigurationRequest for gotenberg_host.
- Adds a defensive re-check in GotenbergPDFDriver before the outbound call to
  cover hosts set via env/seed/stale config or DNS rebinding (TOCTOU).

Adds unit tests for the rule + validator integration.
2026-06-12 09:18:57 +02:00

69 lines
1.9 KiB
PHP

<?php
namespace App\Http\Requests;
use App\Rules\SafeRemoteUrl;
use Illuminate\Foundation\Http\FormRequest;
class PDFConfigurationRequest extends FormRequest
{
/**
* Determine if the user is authorized to make this request.
*/
public function authorize(): bool
{
return true;
}
/**
* Get the validation rules that apply to the request.
*/
public function rules(): array
{
switch ($this->get('pdf_driver')) {
case 'dompdf':
return [
'pdf_driver' => [
'required',
'string',
],
];
case 'gotenberg':
return [
'pdf_driver' => [
'required',
'string',
],
'gotenberg_host' => [
'required',
'url',
new SafeRemoteUrl,
],
'gotenberg_papersize' => [
'required',
'string',
function ($attribute, $value, $fail) {
$reg = "/^\d+(pt|px|pc|mm|cm|in) \d+(pt|px|pc|mm|cm|in)$/";
if (! preg_match($reg, $value)) {
$fail('Invalid papersize, must be in format "210mm 297mm". Accepts: pt,px,pc,mm,cm,in');
}
},
],
'gotenberg_margins' => [
'nullable',
'string',
],
];
default:
return [
'pdf_driver' => [
'required',
'string',
],
];
}
}
}