note 116223 added to function.curl-setopt

If you use cURL to fetch user-supplied URLs (for instance, in a web-based RSS aggregator), be aware of the risk of server-side request forgery (SSRF). This is an attack where the user takes advantage of the fact that cURL requests are sent from the web server itself, to reach network locations they wouldn't be able to reach from outside the network. For instance, they could enter a "http://localhost" URL, and access things on the web server via "localhost". Or, "ftp://localhost". cURL supports a lot of protocols! If you are using CURLOPT_FOLLOWLOCATION, the malicious URL could be in a redirect from the original request. cURL also will follow redirect headers to other protocols! (303 See Other; Location: ftp://localhost). So if you're using cURL with user-supplied URLs, at the very least use CURLOPT_PROTOCOLS (which also sets CURLOPT_REDIR_PROTOCOLS), and either disable CURLOPT_FOLLOWLOCATION or use the "SafeCurl" library to safely follow redirects. ---- Server IP: 72.52.91.14 Probable Submitter: 101.98.247.28 ---- Manual Page -- http://php.net/manual/en/function.curl-setopt.php Edit -- https://master.php.net/note/edit/116223 Del: integrated -- https://master.php.net/note/delete/116223/integrated Del: useless -- https://master.php.net/note/delete/116223/useless Del: bad code -- https://master.php.net/note/delete/116223/bad+code Del: spam -- https://master.php.net/note/delete/116223/spam Del: non-english -- https://master.php.net/note/delete/116223/non-english Del: in docs -- https://master.php.net/note/delete/116223/in+docs Del: other reasons-- https://master.php.net/note/delete/116223 Reject -- https://master.php.net/note/reject/116223 Search -- https://master.php.net/manage/user-notes.php