Repository navigation

Security: Harden social profile URL checks - refs GHSA-c49g-m2cc-w354 - #9264

Merged

christianbeeznest merged 1 commit into

chamilo:1.11.xfrom

christianbeeznest:security/GHSA-c49g-m2cc-w354-1.11.x

Oct 17, 2026

Merged

Security: Harden social profile URL checks - refs GHSA-c49g-m2cc-w354#9264
christianbeeznest merged 1 commit into
chamilo:1.11.xfrom
christianbeeznest:security/GHSA-c49g-m2cc-w354-1.11.x

christianbeeznest commented Oct 17, 2026

Contributor

Fixes GHSA-c49g-m2cc-w354 for the 1.11.x branch.

Validate and pin the resolved IP before each request.
Disable automatic redirects and revalidate each redirect target.
Restrict redirects to HTTP/HTTPS.
Restore TLS certificate verification.
Prevent DNS rebinding by using the validated IP for the connection.
Restrict social profile URLs to HTTP/HTTPS.
Escape the social profile URL before rendering it in href.

Validated with direct SSRF checks:

Direct loopback request: blocked.
Public redirect to loopback: blocked.
Public HTTPS request: allowed.


          Security: Harden social profile URL checks

030fb9e

christianbeeznest merged commit 0fda9c5 into chamilo:1.11.x

1 of 3 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet