v2.1.0

v2.1.0

Safe mode is on by default

XRay fetches URLs that usually come from someone else. It now refuses to fetch anything that isn't a public http or https URL, so an XRay install can't be used to reach the server it runs on or its private network.

• Schemes: only http and https URLs are fetched.
• Addresses: hosts that resolve to loopback, private-network, link-local, cloud metadata (169.254.169.254) or other reserved addresses are refused. So are IP addresses
  written in unusual forms like 2130706433.
• Redirects: every redirect is checked the same way. Credentials are dropped when a redirect goes to a different site.
• DNS: connections go only to the addresses that were checked, so a DNS answer that changes between the check and the request can't get around it.

A refused URL returns a new error, blocked_url.

This uses the new safe mode in p3k/http 0.2.1.

Upgrading

If you use XRay to fetch from your own network, such as a development server, allow it by hostname, IP address or CIDR range:

      $xray = new p3k\XRay([
        'allow_private' => ['dev.example.com', '10.11.11.0/24'],
      ]);

To turn the checks off entirely, for example on a trusted internal network:

      $xray = new p3k\XRay(['safe_mode' => false]);

If you replace $xray->http with your own p3k\HTTP object, safe mode is up to you: call $http->set_safe_mode(true) on it.

The hosted service reads the same list from Config::$allow_private in config.php. It's optional, so existing config files keep working.