[stweil]

The extension fetched user-supplied URLs server-side without any restriction on the host, and followed redirects without validating the redirect target. This allowed unauthenticated server-side request forgery (SSRF) and local file inclusion (LFI):

• tx_dlf[id] and tx_dlf[multiViewSource][] accept an arbitrary URL that the server then fetches via Helper::getUrl(). That helper validated the scheme only, so any host was reachable, including cloud metadata endpoints (169.254.169.254) and internal services.
• IiifUrlReader and FullTextReader used GeneralUtility::getUrl(), which falls back to file_get_contents() for anything that is not http(s). A document could therefore make the server read local files via file:// URLs (e.g. through a METS FLocat or a JSON-LD @context).
• The DOMDocumentValidation middleware validated the host of the initial URL, but Guzzle followed up to 5 redirects without re-validating the target, so a redirect to an internal service bypassed the check.

Fix the request handling so that no request is issued unless it is explicitly safe:

• extract the host validation that the DOMDocumentValidation middleware introduced into a shared Kitodo\Dlf\Service\UrlValidationService, and apply it to every server-side fetch
• make Helper::getUrl() the single chokepoint for server-side fetches: it accepts http(s) only, requires the host to resolve to a public address unless it is allow-listed, and follows redirects manually so that every redirect target is validated again. A redirect target must either stay on the same host or itself be allowed
• replace GeneralUtility::getUrl() in IiifUrlReader and FullTextReader with Helper::getUrl(), which removes the file_get_contents() fallback and adds the missing request timeout
• distinguish trusted from untrusted locations: database records and CLI arguments are fetched without a host check, so that documents hosted on an internal server keep working, while locations that come from request parameters are validated
• additionally resolve AAAA records when checking a host, so that a host with a public A record but a private AAAA record can no longer bypass the check

Document the new behaviour and add unit tests covering the SSRF protection (scheme gate, private/reserved ranges, IPv4-mapped IPv6 bypass, hostAllowList matching, wildcard matching, relative redirect resolution).

Operator impact: hosts that are not publicly routable have to be listed in the new extension configuration setting general.urlAllowList (comma-separated host names, *.wildcards supported). This is required for documents or document resources (e.g. an IIIF image server or an annotation server) that are hosted on an internal host; otherwise those documents are no longer loaded. The DOMDocumentValidation middleware keeps its per-type hostAllowList for the same purpose.

Note: DNS rebinding (a hostname resolving publicly at check time and privately at fetch time) cannot be fully prevented without pinning the resolved address; the fail-closed check of all resolved addresses minimizes the exposure window.

Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
Assisted-by: OpenCode / MiniMax M3.1 Flash (MiniMax)
Signed-off-by: Stefan Weil sw@weilnetz.de

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (54b67b4) to head (b94e737).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@     Coverage Diff      @@
##   main   #2222   +/-   ##
============================
============================

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.