Avoid local network communication / invalid url requests

[friendica.git] / src / Network / Probe.php

diff --git a/src/Network/Probe.php b/src/Network/Probe.php
index 44348dcd7454d505f0a9e5f3f664317d9c3dd344..e1bedf5e5358e1fa51bf9e26aa2d6d4c455a7d9b 100644 (file)
--- a/src/Network/Probe.php
+++ b/src/Network/Probe.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * @copyright Copyright (C) 2010-2022, the Friendica project
+ * @copyright Copyright (C) 2010-2023, the Friendica project
  *
  * @license GNU AGPL version 3 or any later version
  *
@@ -120,6 +120,11 @@ class Probe
 
                $numeric_fields = ['gsid', 'hide', 'account-type', 'manually-approve'];
 
+               if (!empty($data['photo']) && !Network::isValidHttpUrl($data['photo'])) {
+                       Logger::info('Invalid URL for photo', ['url' => $data['url'], 'photo' => $data['photo']]);
+                       unset($data['photo']);
+               }
+
                $newdata = [];
                foreach ($fields as $field) {
                        if (isset($data[$field])) {
@@ -755,7 +760,7 @@ class Probe
                        $result = self::zot($webfinger, $result, $baseurl);
                }
                if ((!$result && ($network == '')) || ($network == Protocol::PUMPIO)) {
-                       $result = self::pumpio($webfinger, $addr);
+                       $result = self::pumpio($webfinger, $addr, $baseurl);
                }
                if (empty($result['network']) && empty($ap_profile['network']) || ($network == Protocol::FEED)) {
                        $result = self::feed($uri);
@@ -1635,7 +1640,7 @@ class Probe
         *
         * @return array Profile data
         */
-       private static function pumpioProfileData(string $profile_link): array
+       private static function pumpioProfileData(string $profile_link, string $baseurl): array
        {
                $curlResult = DI::httpClient()->get($profile_link, HttpClientAccept::HTML);
                if (!$curlResult->isSuccess() || empty($curlResult->getBody())) {
@@ -1681,6 +1686,9 @@ class Probe
                        foreach ($avatar->attributes as $attribute) {
                                if ($attribute->name == 'src') {
                                        $data['photo'] = trim($attribute->value);
+                                       if (!empty($data['photo']) && !parse_url($data['photo'], PHP_URL_SCHEME) && !parse_url($data['photo'], PHP_URL_HOST)) {
+                                               $data['photo'] = $baseurl . $data['photo'];
+                                       }
                                }
                        }
                }
@@ -1696,7 +1704,7 @@ class Probe
         *
         * @return array pump.io data
         */
-       private static function pumpio(array $webfinger, string $addr): array
+       private static function pumpio(array $webfinger, string $addr, string $baseurl): array
        {
                $data = [];
                // The array is reversed to take into account the order of preference for same-rel links
@@ -1728,7 +1736,7 @@ class Probe
                        return [];
                }
 
-               $profile_data = self::pumpioProfileData($data['url']);
+               $profile_data = self::pumpioProfileData($data['url'], $baseurl);
 
                if (!$profile_data) {
                        return [];
@@ -2220,7 +2228,7 @@ class Probe
                        $approfile = ActivityPub\Transmitter::getProfile($uid);
 
                        $split_name = Diaspora::splitName($owner['name']);
-       
+
                        if (empty($owner['gsid'])) {
                                $owner['gsid'] = GServer::getID($approfile['generator']['url']);
                        }
@@ -2257,7 +2265,7 @@ class Probe
                                                'batch'        => $approfile['generator']['url'] . '/receive/public',
                                                'notify'       => $owner['notify'],
                                                'poll'         => $owner['poll'],
-                                               'poco'         => $owner['poco'],                                               
+                                               'poco'         => $owner['poco'],
                                                'network'      => Protocol::DIASPORA,
                                                'pubkey'       => $owner['upubkey'],
                                        ]