Outbound URL Guard

⭐ Found this useful? Install it from Packagist and star OutboundUrlGuard.

Symfony bundle that checks an outbound http or https URL before your app opens the connection. It blocks loopback, private, and reserved addresses, plus cloud metadata, and can pin a hostname to the first public DNS answer.

Compatible with Symfony 7.4, 8.0, and 8.1. PHP 8.2+ (Symfony 8.x requires PHP 8.4+).

This bundle is FrankenPHP worker mode friendly.

Features

• Rejects schemes other than http and https.
• Blocks loopback, RFC1918, link-local, unique-local, and other addresses PHP marks private or reserved.
• Blocks cloud metadata even when allow_private is true, including decimal, hex, and IPv4-mapped forms.
• Optional DNS resolution with an HttpClient resolve pin (IPv4 preferred) and a configurable socket timeout.
• Does not open the HTTP connection. Callers still set TLS, timeouts, and max_redirects: 0.

Installation

composer require nowo-tech/outbound-url-guard-bundle

Flex registers the bundle from type: symfony-bundle. See Installation.

Requirements

• PHP >=8.2 <8.6
• Symfony components ^7.4 || ^8.0 (symfony/config, symfony/dependency-injection, symfony/http-kernel, symfony/process, symfony/yaml)

Configuration

nowo_outbound_url_guard:
    allow_private: false
    resolve_dns: true
    dns_timeout: 2.0

Full key list: Configuration.

Usage

use Nowo\OutboundUrlGuardBundle\Guard\OutboundUrlGuard;

$options = $guard->httpClientOptions($url);
$options['max_redirects'] = 0;

Docker service names: $guard->assertSafe('http://mercure/.well-known/mercure', resolveDns: false);

Documentation

• Installation
• Configuration
• Usage
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• PSR evaluation
• GitHub CI

Tests and coverage

• PHPUnit unit and integration tests (composer test, make test)
• PHP: 100%
• TS/JS: N/A
• Python: N/A

make test-coverage prints the PHP Lines percentage and fails when Clover statement coverage is below 99%. make test-coverage-100 requires 100%.

License

MIT. See LICENSE.

Contributing

See Contributing and the Code of Conduct.

Version policy

The 1.x line is supported. Report vulnerabilities privately as described in Security.

Author

Héctor Franco Aceituno and Nowo.tech.