[LukasReschke]

Whilst we currently state that SSRF is generally outside of our threat model, this is something where we should invest to improve this.

Todos:

• Make sure existing tests pass
• Investigate how far tests can be added
• Rebase and proper commit messages
• phpcs

[LukasReschke]

Couldn't test the app store page as it seems offline currently:

{"reqId":"MgQTR6OISoKtHPl9NqCw","level":2,"time":"2021-03-30T17:57:31+00:00","remoteAddr":"172.18.0.1","user":"--","app":"appstoreFetcher","method":"POST","url":"/index.php","message":"Could not connect to appstore: cURL error 7:  (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://apps.nextcloud.com/api/v1/apps.json","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15","version":"22.0.0.2"}

[LukasReschke]

154	There were 2 errors:
155	
156	1) Test\Http\Client\NegativeDnsCacheTest::testSetNegativeCacheForDnsType
157	Error: Class 'Test\Http\Client\NegativeDnsCache' not found
158	
159	/drone/src/tests/lib/Http/Client/NegativeDnsCacheTest.php:50
160	
161	2) Test\Http\Client\NegativeDnsCacheTest::testIsNegativeCached
162	Error: Class 'Test\Http\Client\NegativeDnsCache' not found
163	
164	/drone/src/tests/lib/Http/Client/NegativeDnsCacheTest.php:50
165	
166	

😢

[MorrisJobke]

Beside my nitpicks it looks good 👍

[LukasReschke]

Rebased and added the suggestions by Morris. (let's hope the tests still pass 😉 )

@rullzer @ChristophWurst - mind giving this a review as well? This will only land in master, so we can iron out any potential bugs before a release :)

[kesselb]

Should be throwIfLocalIp

[MorrisJobke]

@LukasReschke 👀

[sk1p]

Just a quick ping that this PR possibly (probably?) caused a regression for streaming from external storage, please see #30282