PHP Implementation of SafeURL
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.

SafeURL for PHP

Originally contributed by Jack Whitton @fin1te


SafeURL is a library that aids developers in protecting against a class of vulnerabilities known as Server Side Request Forgery. It does this by validating each part of the URL against a configurable white or black list before making an HTTP request. S afeURL is open-source and licensed under MIT.


Clone this repository and import it into your project.


SafeURL intends to be a wrapper replacement for the curl_exec() method from libcurl in PHP. It can simply be replaced with SafeURL::execute() wrapped in a try {} catch {} block.

  try {
      $url = $_GET['url']; // User controlled input

      $curlHandle = curl_init();
      //Your usual cURL options
      curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (SafeURL)');

      //Execute using SafeURL
      $response = SafeURL::execute($url, $curlHandle);
  } catch (Exception $e) {
      //URL wasn't safe


Options such as white and black lists can be modified. For example:

//Create an Options object
$options = new Options();
//Works with regex
$options->addToList('blacklist', 'domain', '([\w\.\-]+\.)?');
$options->addToList('whitelist', 'scheme', 'ftp');

//This will now throw an InvalidDomainException
$response = SafeURL::execute('', $curlHandle, $options);

//Whilst this will be allowed, and return the response
$response = SafeURL::execute('', $curlHandle, $options);