Weave Code
Url Validator Laravel Package
craftcms/url-validator
Validate URLs and IP addresses before opening a connection to guard against SSRF and DNS rebinding. Rejects non-HTTP schemes, private/reserved/loopback addresses, cloud-metadata hosts, and IPv4-embedding IPv6, returning resolved IPs so you can pin the connection.
CraftCms URL Validator blocks Server-Side Request Forgery (SSRF) and DNS rebinding by validating URLs and IP addresses before any connection opens. It rejects non-HTTP schemes, raw IP literals, hex-encoded hostnames, and cloud-metadata domains, plus hostnames resolving to private, loopback, link-local, CGNAT, or metadata IPs.
It returns the resolved IPs so you can pin the connection (e.g. CURLOPT_RESOLVE), closing the rebinding window between validation and request.
- Restricts schemes to http and https only
- Blocks private, reserved, loopback, and cloud-metadata IP ranges
- Detects IPv6 addresses tunneling embedded IPv4 (mapped, NAT64, 6to4, Teredo)
- Returns validated IP addresses for connection pinning
Frequently asked questions about Url Validator
- How do I install craftcms/url-validator in a Laravel app?
- Install it with Composer: composer require craftcms/url-validator. No service provider or config file is required; you can instantiate CraftCms\UrlValidator\UrlValidator directly in controllers, jobs, console commands, or custom validation rules. Then call validate($url) inside a try/catch for UrlValidationException. Keep the returned IPs so the fetch layer can pin the connection.
- Does craftcms/url-validator require a specific Laravel version?
- There is no Laravel dependency, so there is no Laravel version compatibility matrix to check. It is a framework-agnostic PHP package installed via Composer and autoloaded with PSR-4, so it works in Laravel controllers, jobs, commands, and validation rules alike. The real constraint is the PHP version and Composer requirements declared in its composer.json, so confirm those against your runtime first.
- What attacks does craftcms/url-validator prevent?
- It guards against SSRF, DNS rebinding, and cloud-metadata attacks by validating the URL and its resolved IP addresses before any connection opens. By default it rejects unsafe schemes, raw IP literals, hex-encoded hostnames, well-known metadata domains, and hosts that resolve to private, reserved, loopback, link-local, CGNAT, or cloud-metadata addresses. It also rejects IPv6 forms that embed or tunnel IPv4. It returns resolved IPs so you can pin the subsequent connection and avoid a second DNS lookup.
- What Laravel use cases fit this package?
- It fits any Laravel flow that fetches user-influenced URLs: webhook delivery, remote image or link unfurling, RSS and feed ingestion, OAuth/OIDC discovery, and import-from-URL features. The package validates only; it does not fetch. Wrap validation, connection pinning, redirect handling, and retries in a single SafeUrlFetcher-style service so every outbound path uses the guard consistently.
- How do I pin the connection to the resolved IPs with Guzzle or cURL?
- Call validate($url) first and keep the returned IP set. When you make the request, pin the hostname and port to those validated IPs, for example with cURL's CURLOPT_RESOLVE option or the equivalent Guzzle curl option. Do not let the HTTP client resolve the hostname again between validation and connection. If the host has multiple A/AAAA records, pin the set you validated and make sure retries and proxies follow the same rule.
- Does craftcms/url-validator handle redirects?
- No. craftcms/url-validator is a validator, not an HTTP client, so it does not fetch the URL or follow redirects for you. You must re-enter the guard for every redirect target before following it. The safest design is a single fetch abstraction that validates each hop, pins the connection, and enforces a redirect limit.
- What schemes, IP literals, and host forms are rejected by default?
- By default it allows only http and https, blocking file, ftp, gopher, and similar schemes. It rejects raw IP literals, hex-encoded hostnames, well-known cloud-metadata domains, and hostnames resolving to private, reserved, loopback, link-local, CGNAT, or cloud-metadata IPs. It also blocks IPv6 addresses that embed or tunnel IPv4, such as IPv4-mapped, NAT64, 6to4, and Teredo. Test edge cases such as ports, IDN/punycode, trailing-dot hosts, and decimal or octal IP notation against your PHP runtime before relying on them.
- How does it resolve DNS, and does it return all A and AAAA records?
- The README excerpt does not specify whether resolution uses dns_get_record, gethostbynamel, or cURL, so confirm that in the source before adopting it. You should verify that it surfaces all A and AAAA records and the full CNAME chain, especially for split-horizon or multi-record hosts. It does return the resolved IP set for connection pinning, but the pinning contract is yours to honor. If you need custom DNS behavior, test it against your resolver and egress profile.
- Is craftcms/url-validator mature enough for production?
- It has credible signals: a reputable Craft CMS publisher, MIT license, narrow auditable scope, an explicit threat model, and a GitHub Actions test workflow. It also has weak adoption signals: roughly one star, zero dependents, and maturity limited to the README and changelog, so it is effectively unproven in the wild. URL and IP blocklists are moving targets, so verify release cadence, blocklist ownership, and security disclosure policy. Budget a security review and integration tests before production use.
- What alternatives or additional controls should I consider?
- Alternatives include building your own resolver-plus-allowlist guard, using HTTP client middleware or a custom fetch layer, or relying on network egress controls and a metadata-blocking firewall. The package is best adopted as an additive guard, not a replacement for egress controls. Combine it with a single SafeUrlFetcher abstraction, redirect re-validation, connection pinning, and monitoring. That keeps residual SSRF risk focused on integration mistakes rather than library bugs.
Weaver
How can I help you explore Laravel packages today?