Skip to content

Security: Prevent DNS rebinding in link checker - refs GHSA-ggx3-h674-xqq3 - #9269

Merged
christianbeeznest merged 1 commit into
chamilo:3.0from
christianbeeznest:security/GHSA-ggx3-h674-xqq3-3.0
Oct 18, 2026
Merged

christianbeeznest merged 1 commit into
chamilo:3.0from
christianbeeznest:security/GHSA-ggx3-h674-xqq3-3.0

Conversation

@christianbeeznest

Copy link
Copy Markdown
Contributor

Fixes GHSA-ggx3-h674-xqq3 for the 3.0 branch.

  • Prevent DNS rebinding SSRF by pinning cURL connections to validated public IP addresses.
  • Preserve HTTP/HTTPS hostname and TLS verification.
  • Disable proxy-based DNS resolution and automatic redirects.
  • Add regression tests for URL validation and connection security.

Validation: PHP syntax checks passed, PHPUnit passed (4 tests, 20 assertions before ECS formatting), and pre-push checks passed. Live DNS-rebinding testing remains pending.

Refs GHSA-ggx3-h674-xqq3

@christianbeeznest
christianbeeznest merged commit 4849f9c into chamilo:3.0 Oct 18, 2026
1 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant