Mitigate small SSRF (#3861)

Co-authored-by: Martin Stone <[email protected]>

Author: ildyria

app/Image/Files/DownloadedFile.php

@@ -10,6 +10,7 @@
 
 use App\Exceptions\MediaFileOperationException;
 use App\Exceptions\MediaFileUnsupportedException;
+use App\Models\Configs;
 use Safe\Exceptions\PcreException;
 use function Safe\fclose;
 use function Safe\fopen;
@@ -41,7 +42,16 @@ public function __construct(string $url)
 			$basename = pathinfo($path, PATHINFO_FILENAME);
 			$extension = '.' . pathinfo($path, PATHINFO_EXTENSION);
 
-			$download_stream = fopen($url, 'rb');
+			$opts = [
+				'http' => [
+					'follow_location' => !Configs::getValueAsBool('import_via_url_block_redirect'),
+					'max_redirects' => 3,
+					'timeout' => 10.0,
+				],
+			];
+
+			$context = stream_context_create($opts);
+			$download_stream = fopen($url, 'rb', context: $context);
 			$download_stream_data = stream_get_meta_data($download_stream);
 
 			/** @var string|null $original_mime_type */

database/migrations/2025_12_10_171646_add_setting_follow_link_redirection.php

@@ -0,0 +1,34 @@
+<?php
+
+/**
+ * SPDX-License-Identifier: MIT
+ * Copyright (c) 2017-2018 Tobias Reich
+ * Copyright (c) 2018-2025 LycheeOrg.
+ */
+
+use App\Models\Extensions\BaseConfigMigration;
+
+return new class() extends BaseConfigMigration {
+	public const CONFIG = 'Admin';
+
+	/**
+	 * @return array<int,array{key:string,value:string,is_secret:bool,cat:string,type_range:string,description:string,order?:int,not_on_docker?:bool,is_expert?:bool}>
+	 */
+	public function getConfigs(): array
+	{
+		return [
+			[
+				'key' => 'import_via_url_block_redirect',
+				'value' => '1',
+				'cat' => self::CONFIG,
+				'type_range' => self::BOOL,
+				'description' => 'Import via URL should not follow redirections',
+				'details' => '<span class="pi pi-exclamation-triangle text-orange-500"></span> Disabling this exposes your localhost to the Import via URL functionality and could lead to Server-Side Request Forgery (SSRF).',
+				'is_secret' => false,
+				'is_expert' => true,
+				'level' => 0,
+				'order' => 24,
+			],
+		];
+	}
+};