Repository navigation

Block SSRF to private and reserved addresses (fixes #573) - #579

Open

Vitorinox wants to merge 12 commits into

php-embed:masterfrom

Vitorinox:fix/ssrf-573

Open

Block SSRF to private and reserved addresses (fixes #573)#579
Vitorinox wants to merge 12 commits into
php-embed:masterfrom
Vitorinox:fix/ssrf-573

Commits on Oct 9, 2026
- Add IpClassifier with explicit IPv4/IPv6 reserved ranges
  Vitorinox
  committed
  3badc3f
- Add UrlPolicy and BlockedRequestException
  Vitorinox
  committed
  8434302
- Fix resolveUri() dropping the base port
  Vitorinox
  committed
  a9e4643
- Enforce UrlPolicy in CurlDispatcher with pinned DNS and manual redirects
  Vitorinox
  committed
  f01f17e
- Apply UrlPolicy in Crawler for custom PSR-18 clients
  Vitorinox
  committed
  8b485c2
- Skip blocked secondary requests
  Vitorinox
  committed
  98dfd68
- Document SSRF protection
  Vitorinox
  committed
  89f34dc
- Match curl's host verification, redirect limit, and timeout
  Vitorinox
  committed
  0c72582
- Document the SSRF review notes
  Vitorinox
  committed
  c04d1f3
- Keep certificate checks on for non-falsy ssl_verify_peer
  Vitorinox
  committed
  29f2988
- Stop MultipleRequestsTest from calling live DNS
  Vitorinox
  committed
  0019503
Commits on Oct 14, 2026
- Stop page tests from fetching the schema.org context
  Vitorinox
  committed
  4c3b3f1