Bug 2000514

Author: dklawren

src/applications/harbormaster/step/HarbormasterHTTPRequestBuildStepImplementation.php

@@ -60,22 +60,27 @@ public function execute(
     $method = nonempty(idx($settings, 'method'), 'POST');
 
     try {
-      PhabricatorEnv::requireValidRemoteURIForFetch(
-        $uri,
-        array(
-          'http',
-          'https',
-        ));
+      list($fetch_uri, $fetch_host) =
+        PhabricatorEnv::requireSafeRemoteURIForFetch(
+          $uri,
+          array(
+            'http',
+            'https',
+          ));
     } catch (Exception $ex) {
       $this->logSilencedCall($build, $build_target, pht('HTTP Request: Invalid URI'));
       throw new HarbormasterBuildFailureException();
     }
 
-    $future = id(new HTTPSFuture($uri))
+    $future = id(new HTTPSFuture($fetch_uri))
       ->setMethod($method)
       ->setFollowLocation(false)
       ->setTimeout(60);
 
+    if ($fetch_host !== null) {
+      $future->addHeader('Host', $fetch_host);
+    }
+
     $content_type = $settings['content_type'];
     if ($content_type) {
       $future->addHeader('Content-Type', $content_type);

src/applications/herald/worker/HeraldWebhookWorker.php

@@ -185,13 +185,34 @@ private function callWebhookWithLock(
     $signature = PhabricatorHash::digestHMACSHA256($payload, $key);
     $uri = $hook->getWebhookURI();
 
-    $future = id(new HTTPSFuture($uri))
+    try {
+      list($fetch_uri, $fetch_host) =
+        PhabricatorEnv::requireSafeRemoteURIForFetch(
+          $uri,
+          array(
+            'http',
+            'https',
+          ));
+    } catch (Exception $ex) {
+      $this->failRequest(
+        $request,
+        HeraldWebhookRequest::ERRORTYPE_HOOK,
+        HeraldWebhookRequest::ERROR_URI);
+      throw new PhabricatorWorkerPermanentFailureException(
+        $ex->getMessage());
+    }
+
+    $future = id(new HTTPSFuture($fetch_uri))
       ->setMethod('POST')
       ->addHeader('Content-Type', 'application/json')
       ->addHeader('X-Phabricator-Webhook-Signature', $signature)
       ->setTimeout(15)
       ->setData($payload);
 
+    if ($fetch_host !== null) {
+      $future->addHeader('Host', $fetch_host);
+    }
+
     list($status) = $future->resolve();
 
     if ($status->isTimeout()) {

src/infrastructure/env/PhabricatorEnv.php

@@ -850,6 +850,39 @@ public static function requireValidRemoteURIForFetch(
   }
 
 
+  /**
+   * Validate a remote URI and return a rebinding-safe ($fetch_uri, $fetch_host)
+   * pair for use with HTTPSFuture.
+   *
+   * For HTTP, returns the pre-resolved IP URI plus the original domain as the
+   * Host header value, eliminating DNS re-resolution at request time. For
+   * HTTPS, returns the original URI and null (cURL cannot verify SSL certs
+   * against bare IPs, but rebinding is not practical without a valid cert).
+   *
+   * @param string URI to fetch.
+   * @param list<string> Allowed protocols.
+   * @return pair<wild, string|null> Fetch URI and optional Host header value.
+   * @task uri
+   */
+  public static function requireSafeRemoteURIForFetch(
+    $raw_uri,
+    array $protocols) {
+
+    list($resolved_uri, $domain) = self::requireValidRemoteURIForFetch(
+      $raw_uri,
+      $protocols);
+
+    $uri = new PhutilURI($raw_uri);
+    if ($uri->getProtocol() === 'http') {
+      $port = $uri->getPort();
+      $host = $port ? $domain.':'.$port : $domain;
+      return array($resolved_uri, $host);
+    }
+
+    return array($raw_uri, null);
+  }
+
+
   /**
    * Determine if an IP address is in the outbound address blacklist.
    *