Repository navigation

Security: Harden social profile URL checks - refs GHSA-c49g-m2cc-w354 - #9262

Merged

christianbeeznest merged 1 commit into

chamilo:2.0from

christianbeeznest:security/GHSA-c49g-m2cc-w354-2.0

Oct 17, 2026

Merged

Security: Harden social profile URL checks - refs GHSA-c49g-m2cc-w354#9262
christianbeeznest merged 1 commit into
chamilo:2.0from
christianbeeznest:security/GHSA-c49g-m2cc-w354-2.0

christianbeeznest commented Oct 17, 2026

Contributor

Fixes GHSA-c49g-m2cc-w354 for the 3.0 branch.

Route social profile favicon checks through SafeHttpClientHelper.
Block redirects to private/reserved network targets.
Restore TLS certificate verification.
Restrict social profile URLs to HTTP/HTTPS.
Escape the social profile URL before rendering it in href.

Validated with direct SSRF checks:

Direct loopback request: blocked.
Public redirect to loopback: blocked.
Public HTTPS request: allowed.


          Security: Harden social profile URL checks

dc3867a

christianbeeznest merged commit a5a7837 into chamilo:2.0

0 of 7 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet