240 lines
8.0 KiB
PHP
240 lines
8.0 KiB
PHP
<?php
|
||
|
||
namespace App\Support\Integration;
|
||
|
||
/**
|
||
* 防 SSRF：对主站钱包基地址做严格归一化校验。
|
||
*
|
||
* 规则（保守）：
|
||
* - 仅允许 https
|
||
* - 不允许 user/pass、query、fragment
|
||
* - 不允许除 / 以外的 path（即仅允许根地址）
|
||
* - 拒绝 localhost 与私网/保留网段（IP 字面量层面）
|
||
*
|
||
* hostname 的 DNS 解析与请求时固定解析由 WalletApiRequestGuard 负责。
|
||
*/
|
||
final class WalletApiUrlSanitizer
|
||
{
|
||
public static function normalizeAndValidate(?string $raw): ?string
|
||
{
|
||
if (! is_string($raw)) {
|
||
return null;
|
||
}
|
||
|
||
$raw = trim($raw);
|
||
if ($raw === '') {
|
||
return null;
|
||
}
|
||
|
||
// 允许尾部 /，归一化后移除
|
||
$raw = rtrim($raw, " \t\n\r\0\x0B/");
|
||
|
||
$parts = parse_url($raw);
|
||
if (! is_array($parts)) {
|
||
return null;
|
||
}
|
||
|
||
$scheme = strtolower((string) ($parts['scheme'] ?? ''));
|
||
if ($scheme !== 'https') {
|
||
return null;
|
||
}
|
||
|
||
if (isset($parts['user']) || isset($parts['pass'])) {
|
||
return null;
|
||
}
|
||
|
||
if (! isset($parts['host']) || ! is_string($parts['host']) || $parts['host'] === '') {
|
||
return null;
|
||
}
|
||
|
||
if (isset($parts['query']) || isset($parts['fragment'])) {
|
||
return null;
|
||
}
|
||
|
||
$path = (string) ($parts['path'] ?? '');
|
||
if ($path !== '' && $path !== '/') {
|
||
return null;
|
||
}
|
||
|
||
$host = strtolower(trim((string) $parts['host']));
|
||
if ($host === '' || str_contains($host, ' ') || str_contains($host, "\t") || str_contains($host, "\n")) {
|
||
return null;
|
||
}
|
||
|
||
$host = trim($host, '[]');
|
||
|
||
// 明确拦截 localhost / 本地常见名
|
||
if ($host === 'localhost' || $host === 'local' || $host === 'localdomain') {
|
||
return null;
|
||
}
|
||
|
||
// 拦截 IP 字面量私网
|
||
$isIp = filter_var($host, FILTER_VALIDATE_IP) !== false;
|
||
if ($isIp) {
|
||
if (! self::isPublicIp($host)) {
|
||
return null;
|
||
}
|
||
} else {
|
||
$host = rtrim($host, '.');
|
||
if (! str_contains($host, '.')
|
||
|| preg_match('/^[0-9.]+$/D', $host) === 1
|
||
|| preg_match('/(^|\.)(?:0x[0-9a-f]+|0[0-7]+)(?:\.|$)/iD', $host) === 1
|
||
|| filter_var($host, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) === false
|
||
) {
|
||
return null;
|
||
}
|
||
}
|
||
|
||
// 端口校验（允许不写 port）
|
||
if (isset($parts['port'])) {
|
||
$port = (int) $parts['port'];
|
||
if ($port < 1 || $port > 65535) {
|
||
return null;
|
||
}
|
||
}
|
||
|
||
$normalizedHost = filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)
|
||
? '['.$host.']'
|
||
: $host;
|
||
$normalized = 'https://'.$normalizedHost;
|
||
if (isset($parts['port'])) {
|
||
$normalized .= ':'.(string) (int) $parts['port'];
|
||
}
|
||
|
||
return $normalized;
|
||
}
|
||
|
||
public static function isPublicIp(string $ip): bool
|
||
{
|
||
if (filter_var(
|
||
$ip,
|
||
FILTER_VALIDATE_IP,
|
||
FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE,
|
||
) === false) {
|
||
return false;
|
||
}
|
||
|
||
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
|
||
$v = ip2long($ip);
|
||
if ($v === false) {
|
||
return false;
|
||
}
|
||
|
||
// PHP 在 macOS 上 ip2long 可能为有符号，强转为 int64 统一处理
|
||
$v = (int) $v;
|
||
|
||
return ! self::ipInRangesV4((int) $v, [
|
||
// 0.0.0.0/8
|
||
['base' => ip2long('0.0.0.0'), 'mask' => 0xFF000000],
|
||
// 10.0.0.0/8
|
||
['base' => ip2long('10.0.0.0'), 'mask' => 0xFF000000],
|
||
// 127.0.0.0/8
|
||
['base' => ip2long('127.0.0.0'), 'mask' => 0xFF000000],
|
||
// 169.254.0.0/16
|
||
['base' => ip2long('169.254.0.0'), 'mask' => 0xFFFF0000],
|
||
// 172.16.0.0/12
|
||
['base' => ip2long('172.16.0.0'), 'mask' => 0xFFF00000],
|
||
// 192.168.0.0/16
|
||
['base' => ip2long('192.168.0.0'), 'mask' => 0xFFFF0000],
|
||
// 100.64.0.0/10 (CGNAT)
|
||
['base' => ip2long('100.64.0.0'), 'mask' => 0xFFC00000],
|
||
// 192.0.0.0/24 (IETF Protocol Assignments)
|
||
['base' => ip2long('192.0.0.0'), 'mask' => 0xFFFFFF00],
|
||
// Documentation and deprecated relay ranges
|
||
['base' => ip2long('192.0.2.0'), 'mask' => 0xFFFFFF00],
|
||
['base' => ip2long('192.88.99.0'), 'mask' => 0xFFFFFF00],
|
||
['base' => ip2long('198.51.100.0'), 'mask' => 0xFFFFFF00],
|
||
['base' => ip2long('203.0.113.0'), 'mask' => 0xFFFFFF00],
|
||
// 198.18.0.0/15 (benchmarking)
|
||
['base' => ip2long('198.18.0.0'), 'mask' => 0xFFFE0000],
|
||
// 224.0.0.0/4 (multicast)
|
||
['base' => ip2long('224.0.0.0'), 'mask' => 0xF0000000],
|
||
// 240.0.0.0/4 (reserved for future use)
|
||
['base' => ip2long('240.0.0.0'), 'mask' => 0xF0000000],
|
||
]);
|
||
}
|
||
|
||
// IPv6：仅做关键保守段拦截（避免复杂数值比较引入 bug）
|
||
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
|
||
$bin = inet_pton($ip);
|
||
if ($bin === false) {
|
||
return false;
|
||
}
|
||
|
||
// IPv6 ::1 (loopback)
|
||
if (substr($bin, 0, 15) === str_repeat("\0", 15) && $bin[15] === "\1") {
|
||
return false;
|
||
}
|
||
|
||
// IPv6 unspecified ::
|
||
if ($bin === str_repeat("\0", 16)) {
|
||
return false;
|
||
}
|
||
|
||
$b0 = ord($bin[0]);
|
||
$b1 = ord($bin[1]);
|
||
|
||
// ff00::/8 multicast
|
||
if ($b0 === 0xFF) {
|
||
return false;
|
||
}
|
||
|
||
// fc00::/7 unique local => fc or fd
|
||
if ($b0 === 0xFC || $b0 === 0xFD) {
|
||
return false;
|
||
}
|
||
|
||
// fe80::/10 link-local => fe + (second byte & 0xC0) == 0x80
|
||
if ($b0 === 0xFE && (($b1 & 0xC0) === 0x80)) {
|
||
return false;
|
||
}
|
||
|
||
// IPv4-mapped ::ffff:0:0/96 => 检查最后 4 字节映射的 IPv4 是否为私网
|
||
if (substr($bin, 0, 10) === str_repeat("\0", 10) && substr($bin, 10, 2) === "\xFF\xFF") {
|
||
$v4bin = substr($bin, 12, 4);
|
||
$v4 = inet_ntop($v4bin);
|
||
// inet_ntop 对 v4bin 有时返回 false，这里保守拒绝
|
||
if ($v4 === false) {
|
||
return false;
|
||
}
|
||
|
||
return self::isPublicIp($v4);
|
||
}
|
||
|
||
// IPv4 translation prefixes can otherwise tunnel a private IPv4 target.
|
||
$isIpv4Translation = substr($bin, 0, 12) === "\x00\x64\xFF\x9B\x00\x00\x00\x00\x00\x00\x00\x00"
|
||
|| substr($bin, 0, 6) === "\x00\x64\xFF\x9B\x00\x01";
|
||
|
||
// 100::/64 discard-only, 2001::/23 protocol assignments,
|
||
// 2001:db8::/32 and 3fff::/20 documentation, 2002::/16 deprecated 6to4.
|
||
if ($isIpv4Translation
|
||
|| substr($bin, 0, 8) === "\x00\x64\x00\x00\x00\x00\x00\x00"
|
||
|| ($b0 === 0x20 && $b1 === 0x01 && (ord($bin[2]) & 0xFE) === 0)
|
||
|| substr($bin, 0, 4) === "\x20\x01\x0D\xB8"
|
||
|| ($b0 === 0x3F && ($b1 & 0xF0) === 0xF0)
|
||
|| ($b0 === 0x20 && $b1 === 0x02)
|
||
) {
|
||
return false;
|
||
}
|
||
|
||
return true;
|
||
}
|
||
|
||
// 非法 IP：保守拒绝
|
||
return false;
|
||
}
|
||
|
||
private static function ipInRangesV4(int $v, array $ranges): bool
|
||
{
|
||
foreach ($ranges as $r) {
|
||
$base = (int) $r['base'];
|
||
$mask = (int) $r['mask'];
|
||
if (($v & $mask) === ($base & $mask)) {
|
||
return true;
|
||
}
|
||
}
|
||
|
||
return false;
|
||
}
|
||
}
|