PHPackages                             b2bcenter/safecurl - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. b2bcenter/safecurl

AbandonedArchivedLibrary[HTTP & Networking](/categories/http)

b2bcenter/safecurl
==================

A drop-in replacement for 'curl\_exec', designed to prevent SSRF attacks.

1.1.3(8y ago)18.0kMITPHP

Since May 19Pushed 8y ago1 watchersCompare

[ Source](https://github.com/b2bcenter/safecurl)[ Packagist](https://packagist.org/packages/b2bcenter/safecurl)[ RSS](/packages/b2bcenter-safecurl/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (3)DependenciesVersions (6)Used By (0)

SafeCurl
========

[](#safecurl)

SafeCurl intends to be a drop-in replacement for the [curl\_exec](http://php.net/manual/en/function.curl-exec.php) function in PHP. SafeCurl validates each part of the URL against a white or black list, to help protect against Server-Side Request Forgery attacks.

For more infomation about the project see the blog post ['SafeCurl: SSRF Protection, and a "Capture the Bitcoins"'](http://blog.fin1te.net/post/86235998757/safecurl-ssrf-protection-and-a-capture-the-bitcoins).

Protections
-----------

[](#protections)

Each part of the URL is broken down and validated against a white or black list. This includes resolve a domain name to it's IP addresses.

If you chose to enable "FOLLOWLOCATION", then any redirects are caught, and re-validated.

Installation
------------

[](#installation)

SafeCurl can be included in any PHP project using [Composer](https://getcomposer.org). Include the following in your `composer.json` file under `require`.

```
    "require": {
        "fin1te\safecurl": "~1"
    }

```

Then update Composer.

```
composer update

```

Usage
-----

[](#usage)

It's as easy as replacing `curl_exec` with `SafeCurl::execute`, and wrapping it in a `try {} catch {}` block.

```
use fin1te\SafeCurl\SafeCurl;
use fin1te\SafeCurl\Exception;

try {
    $url = 'http://www.google.com';

    $curlHandle = curl_init();
    //Your usual cURL options
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (SafeCurl)');

    //Execute using SafeCurl
    $response = SafeCurl::execute($url, $curlHandle);
} catch (Exception $e) {
    //URL wasn't safe
}
```

#### Options

[](#options)

The default options are to not allow access to any [private IP addresses](http://en.wikipedia.org/wiki/Private_network), and to only allow HTTP(S) connections.

If you wish to add your own options (such as to blacklist any requests to domains your control), simply get a new SimpleCurl\\Options object, add to the white or black lists, and pass it along with the method calls.

Domains are express using regex syntax, whilst IPs, scheme and ports are standard strings (IPs can be specified in [CIDR notation](https://en.wikipedia.org/wiki/Cidr)).

```
use fin1te\SafeCurl\Options;

$options = new Options();
$options->addToList('blacklist', 'domain', '(.*)\.fin1te\.net');
$options->addToList('whitelist', 'scheme', 'ftp');

//This will now throw an InvalidDomainException
$response = SafeCurl::execute('http://safecurl.fin1te.net', $curlHandle, $options);

//Whilst this will be allowed, and return the response
$response = SafeCurl::execute('ftp://fin1te.net', $curlHandle, $options);
```

Since we can't get access to any already set cURL options (see Caveats section), to enable `CURL_FOLLOWREDIRECTS` you must call the `enableFollowRedirects()` method. If you wish to specify a redirect limit, you will need to call `setMaxRedirects()`. Passing in `0` will allow infinite redirects.

```
$options = new Options();
$options->enableFollowLocation();
//Abort after 10 redirects
$options->setFollowLocationLimit(10);
```

#### URL Checking

[](#url-checking)

The URL checking methods are also public, meaning that you can validate a URL before using it elsewhere in your application, although you'd want to try and catch any redirects.

```
use fin1te\SafeCurl\Url;

try {
    $url = 'http://www.google.com';

    $validatedUrl = Url::validateUrl($url);
    $fullUrl = $validatedUrl['url'];
} catch (Exception $e) {
    // URL wasn't safe
}
```

#### Optional Protections

[](#optional-protections)

In addition to the standard checks, two more are available.

The first is to prevent [DNS Rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks. This can be enabled by calling the `enablePinDns` method on an `Options` object. There is one major issue with this - the SSL certificate **can't** be validated. This is due to the real hostname being sent in the `Host` header, and the URL using the IP address.

```
$options = new Options();
$options->enablePinDns();
```

The second disables the use of credentials in a URL, since PHP's `parse_url` returns values which differ from ones cURL uses. This is a temporary fix.

```
$options = new Options();
$options->disableSendCredentials();

//This will throw an InvalidURLException
$response = SafeCurl::execute('http://user:pass@google.com', $curlHandle, $options);
```

#### Cavets

[](#cavets)

Since SafeCurl uses `getaddrbyhostl` to resolve domain names, which isn't IPv6 compatible, the class will only work with IPv4 at the moment. See [Issue #1](https://github.com/fin1te/safecurl/issues/1).

As mentioned above, we can't fetch the value of any cURL options set against the provided cURL handle. Because SafeCurl handles redirects itself, it will turn off `CURLOPT_FOLLOWLOCATION` and use the value from the `Options` object. This is also true of `CURLOPT_MAXREDIRECTS`.

Demo
----

[](#demo)

A live demo is available at . For the site source code (if you're curious), it's hosted at [fin1te/safecurl.fin1te.net](https://github.com/fin1te/safecurl.fin1te.net).

Bounty
------

[](#bounty)

In order to help make SafeCurl secure and ready for production use, [a Bitcoin bounty](http://safecurl.fin1te.net/#bounty) has been setup.

Inside the document root is a [Bitcoin wallet](http://safecurl.fin1te.net/btc.txt), which is only accessible by 127.0.0.1. If you can bypass the protections and grab the file, you're free to take the Bitcoins.

###  Health Score

32

—

LowBetter than 71% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity20

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity67

Established project with proven stability

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~293 days

Total

5

Last Release

3200d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/89f8767bc468702c70bee8a5e11b1fee97c441fd51c43f7036db7b5d9d5b3d29?d=identicon)[medliii](/maintainers/medliii)

---

Top Contributors

[![medliii](https://avatars.githubusercontent.com/u/1991105?v=4)](https://github.com/medliii "medliii (2 commits)")

---

Tags

curlsafessrfsafecurlwebsec

### Embed Badge

![Health badge](/badges/b2bcenter-safecurl/health.svg)

```
[![Health](https://phpackages.com/badges/b2bcenter-safecurl/health.svg)](https://phpackages.com/packages/b2bcenter-safecurl)
```

###  Alternatives

[fin1te/safecurl

A drop-in replacement for 'curl\_exec', designed to prevent SSRF attacks.

7325.7k](/packages/fin1te-safecurl)[rmccue/requests

A HTTP library written in PHP, for human beings.

3.6k34.5M253](/packages/rmccue-requests)[kriswallsmith/buzz

Lightweight HTTP client

2.0k31.3M438](/packages/kriswallsmith-buzz)[mashape/unirest-php

Unirest PHP

1.3k9.7M160](/packages/mashape-unirest-php)[php-http/curl-client

PSR-18 and HTTPlug Async client with cURL

48247.0M383](/packages/php-http-curl-client)[smi2/phpclickhouse

PHP ClickHouse Client

83510.1M71](/packages/smi2-phpclickhouse)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)