Skip to content

Allow restricting CURLOPT_PROXY with get_curl_resolve_info() - #83

Merged
Alkarex merged 6 commits into
FreshRSS:freshrssfrom
Inverle:restrict-curlopt-proxy-ssrf
Jul 23, 2026
Merged

Allow restricting CURLOPT_PROXY with get_curl_resolve_info()#83
Alkarex merged 6 commits into
FreshRSS:freshrssfrom
Inverle:restrict-curlopt-proxy-ssrf

Conversation

@Inverle

@Inverle Inverle commented Jun 28, 2026

Copy link
Copy Markdown
Member

@Inverle
Inverle requested a review from Alkarex June 28, 2026 19:32
@Inverle
Inverle force-pushed the restrict-curlopt-proxy-ssrf branch 2 times, most recently from cd6a9ed to 3781610 Compare June 28, 2026 19:49
@Inverle
Inverle force-pushed the restrict-curlopt-proxy-ssrf branch from 3781610 to acb9077 Compare June 28, 2026 19:54
Comment thread src/File.php
Comment thread src/File.php
@Alkarex

Alkarex commented Jul 19, 2026

Copy link
Copy Markdown
Member

I have made a few fixes. Double-check welcome

@Alkarex
Alkarex merged commit 37ebf58 into FreshRSS:freshrss Jul 23, 2026
11 checks passed
Alkarex added a commit to Inverle/FreshRSS that referenced this pull request Jul 23, 2026
Alkarex added a commit to FreshRSS/FreshRSS that referenced this pull request Jul 23, 2026
* Improve SSRF mitigations by restricting `CURLOPT_PROXY`

Follow-up of #8400
SimplePie PR: FreshRSS/simplepie#83

* Reword docs

* Change single quote to backquote in docs

* Fix `cURL error 5: Could not resolve proxy: Array` error

* Sync SimplePie

* A few fixes

* Implement suggestion

* A few more fixes

* Sync composer
FreshRSS/simplepie#83

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
@Inverle
Inverle deleted the restrict-curlopt-proxy-ssrf branch July 23, 2026 14:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants