nextcloud / server

lib/private/Http/Client/LocalAddressChecker.php

Indentation +58 added lines, -58 removed lines

@@ -33,70 +33,70 @@
 use Symfony\Component\HttpFoundation\IpUtils;
 
 class LocalAddressChecker {
-	private LoggerInterface $logger;
+    private LoggerInterface $logger;
 
-	public function __construct(LoggerInterface $logger) {
-		$this->logger = $logger;
-	}
+    public function __construct(LoggerInterface $logger) {
+        $this->logger = $logger;
+    }
 
-	public function throwIfLocalIp(string $ip) : void {
-		$parsedIp = Factory::parseAddressString(
-			$ip,
-			ParseStringFlag::IPV4_MAYBE_NON_DECIMAL | ParseStringFlag::IPV4ADDRESS_MAYBE_NON_QUAD_DOTTED
-		);
-		if ($parsedIp === null) {
-			/* Not an IP */
-			return;
-		}
-		/* Replace by normalized form */
-		if ($parsedIp instanceof IPv6) {
-			$ip = (string)($parsedIp->toIPv4() ?? $parsedIp);
-		} else {
-			$ip = (string)$parsedIp;
-		}
+    public function throwIfLocalIp(string $ip) : void {
+        $parsedIp = Factory::parseAddressString(
+            $ip,
+            ParseStringFlag::IPV4_MAYBE_NON_DECIMAL | ParseStringFlag::IPV4ADDRESS_MAYBE_NON_QUAD_DOTTED
+        );
+        if ($parsedIp === null) {
+            /* Not an IP */
+            return;
+        }
+        /* Replace by normalized form */
+        if ($parsedIp instanceof IPv6) {
+            $ip = (string)($parsedIp->toIPv4() ?? $parsedIp);
+        } else {
+            $ip = (string)$parsedIp;
+        }
 
-		$localRanges = [
-			'100.64.0.0/10', // See RFC 6598
-			'192.0.0.0/24', // See RFC 6890
-		];
-		if (
-			(bool)filter_var($ip, FILTER_VALIDATE_IP) &&
-			(
-				!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
-				IpUtils::checkIp($ip, $localRanges)
-			)) {
-			$this->logger->warning("Host $ip was not connected to because it violates local access rules");
-			throw new LocalServerException('Host violates local access rules');
-		}
-	}
+        $localRanges = [
+            '100.64.0.0/10', // See RFC 6598
+            '192.0.0.0/24', // See RFC 6890
+        ];
+        if (
+            (bool)filter_var($ip, FILTER_VALIDATE_IP) &&
+            (
+                !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
+                IpUtils::checkIp($ip, $localRanges)
+            )) {
+            $this->logger->warning("Host $ip was not connected to because it violates local access rules");
+            throw new LocalServerException('Host violates local access rules');
+        }
+    }
 
-	public function throwIfLocalAddress(string $uri) : void {
-		$host = parse_url($uri, PHP_URL_HOST);
-		if ($host === false || $host === null) {
-			$this->logger->warning("Could not detect any host in $uri");
-			throw new LocalServerException('Could not detect any host');
-		}
+    public function throwIfLocalAddress(string $uri) : void {
+        $host = parse_url($uri, PHP_URL_HOST);
+        if ($host === false || $host === null) {
+            $this->logger->warning("Could not detect any host in $uri");
+            throw new LocalServerException('Could not detect any host');
+        }
 
-		$host = idn_to_utf8(strtolower(urldecode($host)));
-		// Remove brackets from IPv6 addresses
-		if (strpos($host, '[') === 0 && substr($host, -1) === ']') {
-			$host = substr($host, 1, -1);
-		}
+        $host = idn_to_utf8(strtolower(urldecode($host)));
+        // Remove brackets from IPv6 addresses
+        if (strpos($host, '[') === 0 && substr($host, -1) === ']') {
+            $host = substr($host, 1, -1);
+        }
 
-		// Disallow local network top-level domains from RFC 6762
-		$localTopLevelDomains = ['local','localhost','intranet','internal','private','corp','home','lan'];
-		$topLevelDomain = substr((strrchr($host, '.') ?: ''), 1);
-		if (in_array($topLevelDomain, $localTopLevelDomains)) {
-			$this->logger->warning("Host $host was not connected to because it violates local access rules");
-			throw new LocalServerException('Host violates local access rules');
-		}
+        // Disallow local network top-level domains from RFC 6762
+        $localTopLevelDomains = ['local','localhost','intranet','internal','private','corp','home','lan'];
+        $topLevelDomain = substr((strrchr($host, '.') ?: ''), 1);
+        if (in_array($topLevelDomain, $localTopLevelDomains)) {
+            $this->logger->warning("Host $host was not connected to because it violates local access rules");
+            throw new LocalServerException('Host violates local access rules');
+        }
 
-		// Disallow hostname only
-		if (substr_count($host, '.') === 0 && !(bool)filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-			$this->logger->warning("Host $host was not connected to because it violates local access rules");
-			throw new LocalServerException('Host violates local access rules');
-		}
+        // Disallow hostname only
+        if (substr_count($host, '.') === 0 && !(bool)filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+            $this->logger->warning("Host $host was not connected to because it violates local access rules");
+            throw new LocalServerException('Host violates local access rules');
+        }
 
-		$this->throwIfLocalIp($host);
-	}
+        $this->throwIfLocalIp($host);
+    }
 }

lib/private/Http/Client/Client.php

Indentation +349 added lines, -349 removed lines

@@ -46,353 +46,353 @@
  * @package OC\Http
  */
 class Client implements IClient {
-	/** @var GuzzleClient */
-	private $client;
-	/** @var IConfig */
-	private $config;
-	/** @var ICertificateManager */
-	private $certificateManager;
-	/** @var LocalAddressChecker */
-	private $localAddressChecker;
-
-	public function __construct(
-		IConfig $config,
-		ICertificateManager $certificateManager,
-		GuzzleClient $client,
-		LocalAddressChecker $localAddressChecker
-	) {
-		$this->config = $config;
-		$this->client = $client;
-		$this->certificateManager = $certificateManager;
-		$this->localAddressChecker = $localAddressChecker;
-	}
-
-	private function buildRequestOptions(array $options): array {
-		$proxy = $this->getProxyUri();
-
-		$defaults = [
-			RequestOptions::VERIFY => $this->getCertBundle(),
-			RequestOptions::TIMEOUT => 30,
-		];
-
-		$options['nextcloud']['allow_local_address'] = $this->isLocalAddressAllowed($options);
-		if ($options['nextcloud']['allow_local_address'] === false) {
-			$onRedirectFunction = function (
-				\Psr\Http\Message\RequestInterface $request,
-				\Psr\Http\Message\ResponseInterface $response,
-				\Psr\Http\Message\UriInterface $uri
-			) use ($options) {
-				$this->preventLocalAddress($uri->__toString(), $options);
-			};
-
-			$defaults[RequestOptions::ALLOW_REDIRECTS] = [
-				'on_redirect' => $onRedirectFunction
-			];
-		}
-
-		// Only add RequestOptions::PROXY if Nextcloud is explicitly
-		// configured to use a proxy. This is needed in order not to override
-		// Guzzle default values.
-		if ($proxy !== null) {
-			$defaults[RequestOptions::PROXY] = $proxy;
-		}
-
-		$options = array_merge($defaults, $options);
-
-		if (!isset($options[RequestOptions::HEADERS]['User-Agent'])) {
-			$options[RequestOptions::HEADERS]['User-Agent'] = 'Nextcloud Server Crawler';
-		}
-
-		if (!isset($options[RequestOptions::HEADERS]['Accept-Encoding'])) {
-			$options[RequestOptions::HEADERS]['Accept-Encoding'] = 'gzip';
-		}
-
-		// Fallback for save_to
-		if (isset($options['save_to'])) {
-			$options['sink'] = $options['save_to'];
-			unset($options['save_to']);
-		}
-
-		return $options;
-	}
-
-	private function getCertBundle(): string {
-		// If the instance is not yet setup we need to use the static path as
-		// $this->certificateManager->getAbsoluteBundlePath() tries to instantiate
-		// a view
-		if ($this->config->getSystemValue('installed', false) === false) {
-			return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
-		}
-
-		return $this->certificateManager->getAbsoluteBundlePath();
-	}
-
-	/**
-	 * Returns a null or an associative array specifying the proxy URI for
-	 * 'http' and 'https' schemes, in addition to a 'no' key value pair
-	 * providing a list of host names that should not be proxied to.
-	 *
-	 * @return array|null
-	 *
-	 * The return array looks like:
-	 * [
-	 *   'http' => 'username:password@proxy.example.com',
-	 *   'https' => 'username:password@proxy.example.com',
-	 *   'no' => ['foo.com', 'bar.com']
-	 * ]
-	 *
-	 */
-	private function getProxyUri(): ?array {
-		$proxyHost = $this->config->getSystemValue('proxy', '');
-
-		if ($proxyHost === '' || $proxyHost === null) {
-			return null;
-		}
-
-		$proxyUserPwd = $this->config->getSystemValue('proxyuserpwd', '');
-		if ($proxyUserPwd !== '' && $proxyUserPwd !== null) {
-			$proxyHost = $proxyUserPwd . '@' . $proxyHost;
-		}
-
-		$proxy = [
-			'http' => $proxyHost,
-			'https' => $proxyHost,
-		];
-
-		$proxyExclude = $this->config->getSystemValue('proxyexclude', []);
-		if ($proxyExclude !== [] && $proxyExclude !== null) {
-			$proxy['no'] = $proxyExclude;
-		}
-
-		return $proxy;
-	}
-
-	private function isLocalAddressAllowed(array $options) : bool {
-		if (($options['nextcloud']['allow_local_address'] ?? false) ||
-			$this->config->getSystemValueBool('allow_local_remote_servers', false)) {
-			return true;
-		}
-
-		return false;
-	}
-
-	protected function preventLocalAddress(string $uri, array $options): void {
-		if ($this->isLocalAddressAllowed($options)) {
-			return;
-		}
-
-		$this->localAddressChecker->throwIfLocalAddress($uri);
-	}
-
-	/**
-	 * Sends a GET request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *              'query' => [
-	 *                  'field' => 'abc',
-	 *                  'other_field' => '123',
-	 *                  'file_name' => fopen('/path/to/file', 'r'),
-	 *              ],
-	 *              'headers' => [
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'cookies' => ['
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'allow_redirects' => [
-	 *                   'max'       => 10,  // allow at most 10 redirects.
-	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                   'referer'   => true,     // add a Referer header
-	 *                   'protocols' => ['https'] // only allow https URLs
-	 *              ],
-	 *              'sink' => '/path/to/file', // save to a file or a stream
-	 *              'verify' => true, // bool or string to CA file
-	 *              'debug' => true,
-	 *              'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function get(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('get', $uri, $this->buildRequestOptions($options));
-		$isStream = isset($options['stream']) && $options['stream'];
-		return new Response($response, $isStream);
-	}
-
-	/**
-	 * Sends a HEAD request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *              'headers' => [
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'cookies' => ['
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'allow_redirects' => [
-	 *                   'max'       => 10,  // allow at most 10 redirects.
-	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                   'referer'   => true,     // add a Referer header
-	 *                   'protocols' => ['https'] // only allow https URLs
-	 *              ],
-	 *              'sink' => '/path/to/file', // save to a file or a stream
-	 *              'verify' => true, // bool or string to CA file
-	 *              'debug' => true,
-	 *              'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function head(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('head', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Sends a POST request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *              'body' => [
-	 *                  'field' => 'abc',
-	 *                  'other_field' => '123',
-	 *                  'file_name' => fopen('/path/to/file', 'r'),
-	 *              ],
-	 *              'headers' => [
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'cookies' => ['
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'allow_redirects' => [
-	 *                   'max'       => 10,  // allow at most 10 redirects.
-	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                   'referer'   => true,     // add a Referer header
-	 *                   'protocols' => ['https'] // only allow https URLs
-	 *              ],
-	 *              'sink' => '/path/to/file', // save to a file or a stream
-	 *              'verify' => true, // bool or string to CA file
-	 *              'debug' => true,
-	 *              'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function post(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-
-		if (isset($options['body']) && is_array($options['body'])) {
-			$options['form_params'] = $options['body'];
-			unset($options['body']);
-		}
-		$response = $this->client->request('post', $uri, $this->buildRequestOptions($options));
-		$isStream = isset($options['stream']) && $options['stream'];
-		return new Response($response, $isStream);
-	}
-
-	/**
-	 * Sends a PUT request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *              'body' => [
-	 *                  'field' => 'abc',
-	 *                  'other_field' => '123',
-	 *                  'file_name' => fopen('/path/to/file', 'r'),
-	 *              ],
-	 *              'headers' => [
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'cookies' => ['
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'allow_redirects' => [
-	 *                   'max'       => 10,  // allow at most 10 redirects.
-	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                   'referer'   => true,     // add a Referer header
-	 *                   'protocols' => ['https'] // only allow https URLs
-	 *              ],
-	 *              'sink' => '/path/to/file', // save to a file or a stream
-	 *              'verify' => true, // bool or string to CA file
-	 *              'debug' => true,
-	 *              'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function put(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('put', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Sends a DELETE request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *              'body' => [
-	 *                  'field' => 'abc',
-	 *                  'other_field' => '123',
-	 *                  'file_name' => fopen('/path/to/file', 'r'),
-	 *              ],
-	 *              'headers' => [
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'cookies' => ['
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'allow_redirects' => [
-	 *                   'max'       => 10,  // allow at most 10 redirects.
-	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                   'referer'   => true,     // add a Referer header
-	 *                   'protocols' => ['https'] // only allow https URLs
-	 *              ],
-	 *              'sink' => '/path/to/file', // save to a file or a stream
-	 *              'verify' => true, // bool or string to CA file
-	 *              'debug' => true,
-	 *              'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function delete(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('delete', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
-
-	/**
-	 * Sends a options request
-	 *
-	 * @param string $uri
-	 * @param array $options Array such as
-	 *              'body' => [
-	 *                  'field' => 'abc',
-	 *                  'other_field' => '123',
-	 *                  'file_name' => fopen('/path/to/file', 'r'),
-	 *              ],
-	 *              'headers' => [
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'cookies' => ['
-	 *                  'foo' => 'bar',
-	 *              ],
-	 *              'allow_redirects' => [
-	 *                   'max'       => 10,  // allow at most 10 redirects.
-	 *                   'strict'    => true,     // use "strict" RFC compliant redirects.
-	 *                   'referer'   => true,     // add a Referer header
-	 *                   'protocols' => ['https'] // only allow https URLs
-	 *              ],
-	 *              'sink' => '/path/to/file', // save to a file or a stream
-	 *              'verify' => true, // bool or string to CA file
-	 *              'debug' => true,
-	 *              'timeout' => 5,
-	 * @return IResponse
-	 * @throws \Exception If the request could not get completed
-	 */
-	public function options(string $uri, array $options = []): IResponse {
-		$this->preventLocalAddress($uri, $options);
-		$response = $this->client->request('options', $uri, $this->buildRequestOptions($options));
-		return new Response($response);
-	}
+    /** @var GuzzleClient */
+    private $client;
+    /** @var IConfig */
+    private $config;
+    /** @var ICertificateManager */
+    private $certificateManager;
+    /** @var LocalAddressChecker */
+    private $localAddressChecker;
+
+    public function __construct(
+        IConfig $config,
+        ICertificateManager $certificateManager,
+        GuzzleClient $client,
+        LocalAddressChecker $localAddressChecker
+    ) {
+        $this->config = $config;
+        $this->client = $client;
+        $this->certificateManager = $certificateManager;
+        $this->localAddressChecker = $localAddressChecker;
+    }
+
+    private function buildRequestOptions(array $options): array {
+        $proxy = $this->getProxyUri();
+
+        $defaults = [
+            RequestOptions::VERIFY => $this->getCertBundle(),
+            RequestOptions::TIMEOUT => 30,
+        ];
+
+        $options['nextcloud']['allow_local_address'] = $this->isLocalAddressAllowed($options);
+        if ($options['nextcloud']['allow_local_address'] === false) {
+            $onRedirectFunction = function (
+                \Psr\Http\Message\RequestInterface $request,
+                \Psr\Http\Message\ResponseInterface $response,
+                \Psr\Http\Message\UriInterface $uri
+            ) use ($options) {
+                $this->preventLocalAddress($uri->__toString(), $options);
+            };
+
+            $defaults[RequestOptions::ALLOW_REDIRECTS] = [
+                'on_redirect' => $onRedirectFunction
+            ];
+        }
+
+        // Only add RequestOptions::PROXY if Nextcloud is explicitly
+        // configured to use a proxy. This is needed in order not to override
+        // Guzzle default values.
+        if ($proxy !== null) {
+            $defaults[RequestOptions::PROXY] = $proxy;
+        }
+
+        $options = array_merge($defaults, $options);
+
+        if (!isset($options[RequestOptions::HEADERS]['User-Agent'])) {
+            $options[RequestOptions::HEADERS]['User-Agent'] = 'Nextcloud Server Crawler';
+        }
+
+        if (!isset($options[RequestOptions::HEADERS]['Accept-Encoding'])) {
+            $options[RequestOptions::HEADERS]['Accept-Encoding'] = 'gzip';
+        }
+
+        // Fallback for save_to
+        if (isset($options['save_to'])) {
+            $options['sink'] = $options['save_to'];
+            unset($options['save_to']);
+        }
+
+        return $options;
+    }
+
+    private function getCertBundle(): string {
+        // If the instance is not yet setup we need to use the static path as
+        // $this->certificateManager->getAbsoluteBundlePath() tries to instantiate
+        // a view
+        if ($this->config->getSystemValue('installed', false) === false) {
+            return \OC::$SERVERROOT . '/resources/config/ca-bundle.crt';
+        }
+
+        return $this->certificateManager->getAbsoluteBundlePath();
+    }
+
+    /**
+     * Returns a null or an associative array specifying the proxy URI for
+     * 'http' and 'https' schemes, in addition to a 'no' key value pair
+     * providing a list of host names that should not be proxied to.
+     *
+     * @return array|null
+     *
+     * The return array looks like:
+     * [
+     *   'http' => 'username:password@proxy.example.com',
+     *   'https' => 'username:password@proxy.example.com',
+     *   'no' => ['foo.com', 'bar.com']
+     * ]
+     *
+     */
+    private function getProxyUri(): ?array {
+        $proxyHost = $this->config->getSystemValue('proxy', '');
+
+        if ($proxyHost === '' || $proxyHost === null) {
+            return null;
+        }
+
+        $proxyUserPwd = $this->config->getSystemValue('proxyuserpwd', '');
+        if ($proxyUserPwd !== '' && $proxyUserPwd !== null) {
+            $proxyHost = $proxyUserPwd . '@' . $proxyHost;
+        }
+
+        $proxy = [
+            'http' => $proxyHost,
+            'https' => $proxyHost,
+        ];
+
+        $proxyExclude = $this->config->getSystemValue('proxyexclude', []);
+        if ($proxyExclude !== [] && $proxyExclude !== null) {
+            $proxy['no'] = $proxyExclude;
+        }
+
+        return $proxy;
+    }
+
+    private function isLocalAddressAllowed(array $options) : bool {
+        if (($options['nextcloud']['allow_local_address'] ?? false) ||
+            $this->config->getSystemValueBool('allow_local_remote_servers', false)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    protected function preventLocalAddress(string $uri, array $options): void {
+        if ($this->isLocalAddressAllowed($options)) {
+            return;
+        }
+
+        $this->localAddressChecker->throwIfLocalAddress($uri);
+    }
+
+    /**
+     * Sends a GET request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *              'query' => [
+     *                  'field' => 'abc',
+     *                  'other_field' => '123',
+     *                  'file_name' => fopen('/path/to/file', 'r'),
+     *              ],
+     *              'headers' => [
+     *                  'foo' => 'bar',
+     *              ],
+     *              'cookies' => ['
+     *                  'foo' => 'bar',
+     *              ],
+     *              'allow_redirects' => [
+     *                   'max'       => 10,  // allow at most 10 redirects.
+     *                   'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                   'referer'   => true,     // add a Referer header
+     *                   'protocols' => ['https'] // only allow https URLs
+     *              ],
+     *              'sink' => '/path/to/file', // save to a file or a stream
+     *              'verify' => true, // bool or string to CA file
+     *              'debug' => true,
+     *              'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function get(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('get', $uri, $this->buildRequestOptions($options));
+        $isStream = isset($options['stream']) && $options['stream'];
+        return new Response($response, $isStream);
+    }
+
+    /**
+     * Sends a HEAD request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *              'headers' => [
+     *                  'foo' => 'bar',
+     *              ],
+     *              'cookies' => ['
+     *                  'foo' => 'bar',
+     *              ],
+     *              'allow_redirects' => [
+     *                   'max'       => 10,  // allow at most 10 redirects.
+     *                   'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                   'referer'   => true,     // add a Referer header
+     *                   'protocols' => ['https'] // only allow https URLs
+     *              ],
+     *              'sink' => '/path/to/file', // save to a file or a stream
+     *              'verify' => true, // bool or string to CA file
+     *              'debug' => true,
+     *              'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function head(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('head', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Sends a POST request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *              'body' => [
+     *                  'field' => 'abc',
+     *                  'other_field' => '123',
+     *                  'file_name' => fopen('/path/to/file', 'r'),
+     *              ],
+     *              'headers' => [
+     *                  'foo' => 'bar',
+     *              ],
+     *              'cookies' => ['
+     *                  'foo' => 'bar',
+     *              ],
+     *              'allow_redirects' => [
+     *                   'max'       => 10,  // allow at most 10 redirects.
+     *                   'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                   'referer'   => true,     // add a Referer header
+     *                   'protocols' => ['https'] // only allow https URLs
+     *              ],
+     *              'sink' => '/path/to/file', // save to a file or a stream
+     *              'verify' => true, // bool or string to CA file
+     *              'debug' => true,
+     *              'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function post(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+
+        if (isset($options['body']) && is_array($options['body'])) {
+            $options['form_params'] = $options['body'];
+            unset($options['body']);
+        }
+        $response = $this->client->request('post', $uri, $this->buildRequestOptions($options));
+        $isStream = isset($options['stream']) && $options['stream'];
+        return new Response($response, $isStream);
+    }
+
+    /**
+     * Sends a PUT request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *              'body' => [
+     *                  'field' => 'abc',
+     *                  'other_field' => '123',
+     *                  'file_name' => fopen('/path/to/file', 'r'),
+     *              ],
+     *              'headers' => [
+     *                  'foo' => 'bar',
+     *              ],
+     *              'cookies' => ['
+     *                  'foo' => 'bar',
+     *              ],
+     *              'allow_redirects' => [
+     *                   'max'       => 10,  // allow at most 10 redirects.
+     *                   'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                   'referer'   => true,     // add a Referer header
+     *                   'protocols' => ['https'] // only allow https URLs
+     *              ],
+     *              'sink' => '/path/to/file', // save to a file or a stream
+     *              'verify' => true, // bool or string to CA file
+     *              'debug' => true,
+     *              'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function put(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('put', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Sends a DELETE request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *              'body' => [
+     *                  'field' => 'abc',
+     *                  'other_field' => '123',
+     *                  'file_name' => fopen('/path/to/file', 'r'),
+     *              ],
+     *              'headers' => [
+     *                  'foo' => 'bar',
+     *              ],
+     *              'cookies' => ['
+     *                  'foo' => 'bar',
+     *              ],
+     *              'allow_redirects' => [
+     *                   'max'       => 10,  // allow at most 10 redirects.
+     *                   'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                   'referer'   => true,     // add a Referer header
+     *                   'protocols' => ['https'] // only allow https URLs
+     *              ],
+     *              'sink' => '/path/to/file', // save to a file or a stream
+     *              'verify' => true, // bool or string to CA file
+     *              'debug' => true,
+     *              'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function delete(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('delete', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
+
+    /**
+     * Sends a options request
+     *
+     * @param string $uri
+     * @param array $options Array such as
+     *              'body' => [
+     *                  'field' => 'abc',
+     *                  'other_field' => '123',
+     *                  'file_name' => fopen('/path/to/file', 'r'),
+     *              ],
+     *              'headers' => [
+     *                  'foo' => 'bar',
+     *              ],
+     *              'cookies' => ['
+     *                  'foo' => 'bar',
+     *              ],
+     *              'allow_redirects' => [
+     *                   'max'       => 10,  // allow at most 10 redirects.
+     *                   'strict'    => true,     // use "strict" RFC compliant redirects.
+     *                   'referer'   => true,     // add a Referer header
+     *                   'protocols' => ['https'] // only allow https URLs
+     *              ],
+     *              'sink' => '/path/to/file', // save to a file or a stream
+     *              'verify' => true, // bool or string to CA file
+     *              'debug' => true,
+     *              'timeout' => 5,
+     * @return IResponse
+     * @throws \Exception If the request could not get completed
+     */
+    public function options(string $uri, array $options = []): IResponse {
+        $this->preventLocalAddress($uri, $options);
+        $response = $this->client->request('options', $uri, $this->buildRequestOptions($options));
+        return new Response($response);
+    }
 }

lib/private/Http/Client/DnsPinMiddleware.php

Indentation +119 added lines, -119 removed lines

@@ -28,123 +28,123 @@
 use Psr\Http\Message\RequestInterface;
 
 class DnsPinMiddleware {
-	/** @var NegativeDnsCache */
-	private $negativeDnsCache;
-	/** @var LocalAddressChecker */
-	private $localAddressChecker;
-
-	public function __construct(
-		NegativeDnsCache $negativeDnsCache,
-		LocalAddressChecker $localAddressChecker
-	) {
-		$this->negativeDnsCache = $negativeDnsCache;
-		$this->localAddressChecker = $localAddressChecker;
-	}
-
-	/**
-	 * Fetch soa record for a target
-	 *
-	 * @param string $target
-	 * @return array|null
-	 */
-	private function soaRecord(string $target): ?array {
-		$labels = explode('.', $target);
-
-		$top = count($labels) >= 2 ? array_pop($labels) : '';
-		$second = array_pop($labels);
-
-		$hostname = $second . '.' . $top;
-		$responses = dns_get_record($hostname, DNS_SOA);
-
-		if ($responses === false || count($responses) === 0) {
-			return null;
-		}
-
-		return reset($responses);
-	}
-
-	private function dnsResolve(string $target, int $recursionCount) : array {
-		if ($recursionCount >= 10) {
-			return [];
-		}
-
-		$recursionCount++;
-		$targetIps = [];
-
-		$soaDnsEntry = $this->soaRecord($target);
-		$dnsNegativeTtl = $soaDnsEntry['minimum-ttl'] ?? null;
-
-		$dnsTypes = [DNS_A, DNS_AAAA, DNS_CNAME];
-		foreach ($dnsTypes as $dnsType) {
-			if ($this->negativeDnsCache->isNegativeCached($target, $dnsType)) {
-				continue;
-			}
-
-			$dnsResponses = dns_get_record($target, $dnsType);
-			$canHaveCnameRecord = true;
-			if ($dnsResponses !== false && count($dnsResponses) > 0) {
-				foreach ($dnsResponses as $dnsResponse) {
-					if (isset($dnsResponse['ip'])) {
-						$targetIps[] = $dnsResponse['ip'];
-						$canHaveCnameRecord = false;
-					} elseif (isset($dnsResponse['ipv6'])) {
-						$targetIps[] = $dnsResponse['ipv6'];
-						$canHaveCnameRecord = false;
-					} elseif (isset($dnsResponse['target']) && $canHaveCnameRecord) {
-						$targetIps = array_merge($targetIps, $this->dnsResolve($dnsResponse['target'], $recursionCount));
-						$canHaveCnameRecord = true;
-					}
-				}
-			} elseif ($dnsNegativeTtl !== null) {
-				$this->negativeDnsCache->setNegativeCacheForDnsType($target, $dnsType, $dnsNegativeTtl);
-			}
-		}
-
-		return $targetIps;
-	}
-
-	public function addDnsPinning() {
-		return function (callable $handler) {
-			return function (
-				RequestInterface $request,
-				array $options
-			) use ($handler) {
-				if ($options['nextcloud']['allow_local_address'] === true) {
-					return $handler($request, $options);
-				}
-
-				$hostName = (string)$request->getUri()->getHost();
-				$port = $request->getUri()->getPort();
-
-				$ports = [
-					'80',
-					'443',
-				];
-
-				if ($port !== null) {
-					$ports[] = (string)$port;
-				}
-
-				$targetIps = $this->dnsResolve(idn_to_utf8($hostName), 0);
-
-				$curlResolves = [];
-
-				foreach ($ports as $port) {
-					$curlResolves["$hostName:$port"] = [];
-
-					foreach ($targetIps as $ip) {
-						$this->localAddressChecker->throwIfLocalIp($ip);
-						$curlResolves["$hostName:$port"][] = $ip;
-					}
-				}
-
-				// Coalesce the per-host:port ips back into a comma separated list
-				foreach ($curlResolves as $hostport => $ips) {
-					$options['curl'][CURLOPT_RESOLVE][] = "$hostport:" . implode(',', $ips);
-				}
-
-				return $handler($request, $options);
-			};
-		};
-	}
+    /** @var NegativeDnsCache */
+    private $negativeDnsCache;
+    /** @var LocalAddressChecker */
+    private $localAddressChecker;
+
+    public function __construct(
+        NegativeDnsCache $negativeDnsCache,
+        LocalAddressChecker $localAddressChecker
+    ) {
+        $this->negativeDnsCache = $negativeDnsCache;
+        $this->localAddressChecker = $localAddressChecker;
+    }
+
+    /**
+     * Fetch soa record for a target
+     *
+     * @param string $target
+     * @return array|null
+     */
+    private function soaRecord(string $target): ?array {
+        $labels = explode('.', $target);
+
+        $top = count($labels) >= 2 ? array_pop($labels) : '';
+        $second = array_pop($labels);
+
+        $hostname = $second . '.' . $top;
+        $responses = dns_get_record($hostname, DNS_SOA);
+
+        if ($responses === false || count($responses) === 0) {
+            return null;
+        }
+
+        return reset($responses);
+    }
+
+    private function dnsResolve(string $target, int $recursionCount) : array {
+        if ($recursionCount >= 10) {
+            return [];
+        }
+
+        $recursionCount++;
+        $targetIps = [];
+
+        $soaDnsEntry = $this->soaRecord($target);
+        $dnsNegativeTtl = $soaDnsEntry['minimum-ttl'] ?? null;
+
+        $dnsTypes = [DNS_A, DNS_AAAA, DNS_CNAME];
+        foreach ($dnsTypes as $dnsType) {
+            if ($this->negativeDnsCache->isNegativeCached($target, $dnsType)) {
+                continue;
+            }
+
+            $dnsResponses = dns_get_record($target, $dnsType);
+            $canHaveCnameRecord = true;
+            if ($dnsResponses !== false && count($dnsResponses) > 0) {
+                foreach ($dnsResponses as $dnsResponse) {
+                    if (isset($dnsResponse['ip'])) {
+                        $targetIps[] = $dnsResponse['ip'];
+                        $canHaveCnameRecord = false;
+                    } elseif (isset($dnsResponse['ipv6'])) {
+                        $targetIps[] = $dnsResponse['ipv6'];
+                        $canHaveCnameRecord = false;
+                    } elseif (isset($dnsResponse['target']) && $canHaveCnameRecord) {
+                        $targetIps = array_merge($targetIps, $this->dnsResolve($dnsResponse['target'], $recursionCount));
+                        $canHaveCnameRecord = true;
+                    }
+                }
+            } elseif ($dnsNegativeTtl !== null) {
+                $this->negativeDnsCache->setNegativeCacheForDnsType($target, $dnsType, $dnsNegativeTtl);
+            }
+        }
+
+        return $targetIps;
+    }
+
+    public function addDnsPinning() {
+        return function (callable $handler) {
+            return function (
+                RequestInterface $request,
+                array $options
+            ) use ($handler) {
+                if ($options['nextcloud']['allow_local_address'] === true) {
+                    return $handler($request, $options);
+                }
+
+                $hostName = (string)$request->getUri()->getHost();
+                $port = $request->getUri()->getPort();
+
+                $ports = [
+                    '80',
+                    '443',
+                ];
+
+                if ($port !== null) {
+                    $ports[] = (string)$port;
+                }
+
+                $targetIps = $this->dnsResolve(idn_to_utf8($hostName), 0);
+
+                $curlResolves = [];
+
+                foreach ($ports as $port) {
+                    $curlResolves["$hostName:$port"] = [];
+
+                    foreach ($targetIps as $ip) {
+                        $this->localAddressChecker->throwIfLocalIp($ip);
+                        $curlResolves["$hostName:$port"][] = $ip;
+                    }
+                }
+
+                // Coalesce the per-host:port ips back into a comma separated list
+                foreach ($curlResolves as $hostport => $ips) {
+                    $options['curl'][CURLOPT_RESOLVE][] = "$hostport:" . implode(',', $ips);
+                }
+
+                return $handler($request, $options);
+            };
+        };
+    }
 }