WordPress.org
Get WordPress

Plugin Directory

Changeset 3349556


Ignore:
Timestamp:
08/25/2025 09:26:09 AM (7 months ago)
Author:
gfazioli
Message:

Fix SSRF vulnerability in external banner uploads

File:
1 edited

Legend:

Unmodified
Added
Removed

  • wp-bannerize-pro/trunk/plugin/CustomPostTypes/WPBannerizeCustomPostType.php

    r3249499 r3349556  
    218218
    219219  /**
     220   * Check if the given URL is a remote image.
     221   *
     222   * @param string $url The URL to check.
     223   * @return bool True if the URL is a remote image, false otherwise.
     224   */
     225  private function wp_bannerize_is_remote_image($url)
     226  {
     227    if (!filter_var($url, FILTER_VALIDATE_URL)) {
     228      return false;
     229    }
     230
     231    $ch = curl_init($url);
     232    curl_setopt($ch, CURLOPT_NOBODY, true);
     233    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
     234    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
     235    curl_setopt($ch, CURLOPT_TIMEOUT, 5);
     236
     237    curl_exec($ch);
     238
     239    $contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);
     240    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
     241
     242    curl_close($ch);
     243
     244    if ($httpCode === 200 && in_array($contentType, ['image/jpeg', 'image/png', 'image/gif'])) {
     245      return true;
     246    }
     247
     248    return false;
     249  }
     250
     251  /**
    220252   * Override this method to save/update your custom data.
    221253   * This method is called by hook action save_post_{post_type}`
    … …  
    239271      $urlMine = $type == 'local' ? $url : $urlExt;
    240272      $size = $this->getBanner($post_id)->getSizeWithURL($urlMine);
     273
     274      // SSRF fix
     275      if (!empty($urlExt)) {
     276        if (!$this->wp_bannerize_is_remote_image($urlExt)) {
     277          // Remove or do not save the invalid URL
     278          delete_post_meta($post_id, 'wp_bannerize_banner_external_url');
     279          // Show an error message to the user
     280          add_filter('redirect_post_location', function ($location) {
     281            return add_query_arg('banner_image_error', 1, $location);
     282          });
     283        }
     284      }
    241285
    242286      if (isset($size) && is_array($size) && count($size) >= 2) {
Note: See TracChangeset for help on using the changeset viewer.