Req #77991 [NEW]: Expose cURL URL parsing functions

From: martijn at vanderven dot se Operating system: PHP version: Irrelevant Package: cURL related Bug Type: Feature/Change Request Bug description:Expose cURL URL parsing functions Description: ------------ Since curl 7.62.0 [1] there has been a URL Parser [2] available from libcurl. It would be great if PHP could expose those through ext/curl. Getting access to those functions would help in securing applications against a number of SSRF attacks [3] that depend on projects using a different URL parser for URL validation than used by the HTTP library for issuing the request. See Orange Tsai’s amazing presentation about this at Black Hat USA 2017 [4][5]. [1]: https://daniel.haxx.se/blog/2018/10/31/curl-7-62-0-moar-stuff/ [2]: https://daniel.haxx.se/blog/2018/09/09/libcurl-gets-a-url-api/ [3]: https://www.owasp.org/index.php/Server_Side_Request_Forgery [4]: https://www.blackhat.com/us-17/briefings.html#a-new-era-of-ssrf-exploiting-url-parser-in-trending-programming-languages [5]: https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf -- Edit bug report at https://bugs.php.net/bug.php?id=77991&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77991&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77991&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77991&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77991&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77991&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77991&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77991&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77991&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77991&r=support Expected behavior: https://bugs.php.net/fix.php?id=77991&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77991&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77991&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77991&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77991&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77991&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77991&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77991&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77991&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77991&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77991&r=mysqlcfg