Use cURL for Bluesky API calls instead of file_get_contents #5

Merged

thatguygriff merged 1 commits from fix/curl-transport-freshrss-130 into main

2026-09-10 13:35:36 +00:00

Author	SHA1	Message	Date
KydoimosandClaude Opus 5	583c489074	Use cURL for Bluesky API calls instead of file_get_contents CI / test (pull_request) Successful in 40s Details FreshRSS 1.30.0 added unregister_unsafe_protocols() to lib/lib_rss.php, which unregisters every PHP stream wrapper except file:// and php:// at boot as an SSRF mitigation. That removed the https:// wrapper, so the stream-context-based fetch in apiGet() stopped working entirely — every API call failed with "Unable to find the wrapper https". Because the call site used @file_get_contents(), the failure was silent: apiGet() returned null, loadThread() fell through to its null fallback, and entries were saved with their unenriched RSS content. The visible symptom was Bluesky posts rendering with no thread and no embeds, with nothing in the logs to explain it. Switch apiGet() to cURL, which does not go through stream wrappers (and is how FreshRSS fetches feeds itself, which is why feed retrieval kept working throughout). Connect timeout added and redirect-following explicitly disabled — a public XRPC endpoint has no reason to redirect, and following redirects would reopen an SSRF vector. Also stop swallowing failures: transport errors, non-2xx responses and malformed JSON are now reported via Minz_Log::warning() so this class of breakage is visible next time. Tests: add testApiGetWorksWithoutHttpsStreamWrapper, which unregisters the https wrapper before calling the API and so fails against the old implementation, plus testApiGetLogsWarningOnFailure. Add a Minz_Log stub and curl to the CI extension list. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-10 10:32:55 -03:00

Author

SHA1

Message

Date

KydoimosandClaude Opus 5

583c489074

Use cURL for Bluesky API calls instead of file_get_contents

CI / test (pull_request) Successful in 40s

Details

FreshRSS 1.30.0 added unregister_unsafe_protocols() to lib/lib_rss.php,
which unregisters every PHP stream wrapper except file:// and php:// at
boot as an SSRF mitigation. That removed the https:// wrapper, so the
stream-context-based fetch in apiGet() stopped working entirely — every
API call failed with "Unable to find the wrapper https".

Because the call site used @file_get_contents(), the failure was silent:
apiGet() returned null, loadThread() fell through to its null fallback,
and entries were saved with their unenriched RSS content. The visible
symptom was Bluesky posts rendering with no thread and no embeds, with
nothing in the logs to explain it.

Switch apiGet() to cURL, which does not go through stream wrappers (and
is how FreshRSS fetches feeds itself, which is why feed retrieval kept
working throughout). Connect timeout added and redirect-following
explicitly disabled — a public XRPC endpoint has no reason to redirect,
and following redirects would reopen an SSRF vector.

Also stop swallowing failures: transport errors, non-2xx responses and
malformed JSON are now reported via Minz_Log::warning() so this class of
breakage is visible next time.

Tests: add testApiGetWorksWithoutHttpsStreamWrapper, which unregisters
the https wrapper before calling the API and so fails against the old
implementation, plus testApiGetLogsWarningOnFailure. Add a Minz_Log stub
and curl to the CI extension list.

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-09-10 10:32:55 -03:00