System\Classes\ResizeImages\ValidatesExternalImages

Overview

ValidatesExternalImages guards the external image fetcher against SSRF and non-image sources; kept separate from the resizer's core logic

Protected Methods

protected isCanonicalHost()

protected isCanonicalHost($host): bool 

isCanonicalHost rejects non-canonical numeric IPv4 spellings (leading-zero/octal, hex, abbreviated, integer) that dns_get_record and libc getaddrinfo parse differently

protected normalizeIpForRangeCheck()

protected normalizeIpForRangeCheck($ip): string|null 

normalizeIpForRangeCheck converts IPv4-mapped and IPv4-compatible IPv6 addresses to their embedded IPv4 form so private-range checks apply

protected validateExternalImageHost()

protected validateExternalImageHost($url): bool 

validateExternalImageHost rejects URLs whose scheme is not http(s) or whose host resolves to a loopback, private, link-local, or reserved address

protected validateExternalImageUrl()

protected validateExternalImageUrl($url): bool 

validateExternalImageUrl checks if an external URL has a valid image extension

protected validateImageContents()

protected validateImageContents($contents): bool 

validateImageContents checks the fetched bytes are actually an image by MIME type