Merge branch '5.x' into 6.x

# Conflicts:
#	.github/workflows/pint-lint.yml
#	.github/workflows/release.yml
#	.github/workflows/tests.yml
#	CHANGELOG.md
#	composer.json
#	resources/js/components/fieldtypes/assets/AssetRow.vue
#	resources/js/components/fieldtypes/assets/AssetTile.vue

Author: jasonvarga

src/Forms/Exporters/CsvExporter.php

@@ -2,6 +2,7 @@
 
 namespace Statamic\Forms\Exporters;
 
+use League\Csv\EscapeFormula;
 use League\Csv\Writer;
 use SplTempFileObject;
 use Statamic\Support\Arr;
@@ -17,6 +18,7 @@ public function export(): string
     {
         $this->writer = Writer::createFromFileObject(new SplTempFileObject);
         $this->writer->setDelimiter(Arr::get($this->config, 'delimiter', config('statamic.forms.csv_delimiter', ',')));
+        $this->writer->addFormatter(new EscapeFormula("'"));
 
         $this->insertHeaders();
 

src/Imaging/GuzzleAdapter.php

@@ -6,6 +6,8 @@
 use GuzzleHttp\ClientInterface;
 use GuzzleHttp\Exception\BadResponseException;
 use GuzzleHttp\Exception\ClientException;
+use GuzzleHttp\Psr7\Uri;
+use GuzzleHttp\Psr7\UriResolver;
 use League\Flysystem\Config;
 use League\Flysystem\FileAttributes;
 use League\Flysystem\FilesystemAdapter;
@@ -14,6 +16,13 @@
 
 class GuzzleAdapter implements FilesystemAdapter
 {
+    /**
+     * The maximum number of redirects to follow.
+     *
+     * @var int
+     */
+    const MAX_REDIRECTS = 5;
+
     /**
      * Whether this endpoint supports head requests.
      *
@@ -149,18 +158,12 @@ public function visibility(string $path): FileAttributes
     protected function get($path)
     {
         try {
-            $response = $this->client->get($this->base.$path, $this->requestOptions());
-        } catch (InvalidRemoteUrlException $e) {
-            throw $e;
+            $response = $this->send('GET', $this->base.$path);
         } catch (BadResponseException $e) {
             return false;
         }
 
-        if ($response->getStatusCode() !== 200) {
-            return false;
-        }
-
-        return $response;
+        return $response->getStatusCode() === 200 ? $response : false;
     }
 
     /**
@@ -176,7 +179,7 @@ protected function head($path)
         }
 
         try {
-            $response = $this->client->head($this->base.$path, $this->requestOptions());
+            $response = $this->send('HEAD', $this->base.$path);
         } catch (ClientException $e) {
             if ($e->getResponse()->getStatusCode() === 405) {
                 $this->supportsHead = false;
@@ -185,27 +188,54 @@ protected function head($path)
             }
 
             return false;
-        } catch (InvalidRemoteUrlException $e) {
-            throw $e;
         } catch (BadResponseException $e) {
             return false;
         }
 
-        if ($response->getStatusCode() !== 200) {
-            return false;
+        return $response->getStatusCode() === 200 ? $response : false;
+    }
+
+    /**
+     * Send a request, pinning the connection to the validated IP so the host
+     * cannot be rebound to an internal address between validation and the
+     * actual fetch. Redirects are followed manually so each hop is validated
+     * and pinned too.
+     */
+    protected function send(string $method, string $url, int $redirects = 0)
+    {
+        // The connection is pinned to the validated IP via curl's CURLOPT_RESOLVE,
+        // which the stream handler has no equivalent for. Rather than silently fall
+        // back to an unpinned (rebindable) request, refuse to fetch without curl.
+        if (! $this->supportsConnectionPinning()) {
+            throw new \RuntimeException('The curl PHP extension is required to fetch remote images.');
+        }
+
+        $resolved = app(RemoteUrlValidator::class)->resolve($url);
+
+        $response = $this->client->request($method, $url, [
+            'allow_redirects' => false,
+            'curl' => [
+                CURLOPT_RESOLVE => [sprintf('%s:%d:%s', $resolved['host'], $resolved['port'], implode(',', $resolved['ips']))],
+            ],
+        ]);
+
+        $status = $response->getStatusCode();
+
+        if ($status >= 300 && $status < 400 && $response->hasHeader('Location')) {
+            if ($redirects >= self::MAX_REDIRECTS) {
+                throw new InvalidRemoteUrlException('Too many redirects.');
+            }
+
+            $location = UriResolver::resolve(new Uri($url), new Uri($response->getHeaderLine('Location')));
+
+            return $this->send($method, (string) $location, $redirects + 1);
         }
 
         return $response;
     }
 
-    protected function requestOptions()
+    protected function supportsConnectionPinning(): bool
     {
-        return [
-            'allow_redirects' => [
-                'on_redirect' => function ($request, $response, $uri) {
-                    app(RemoteUrlValidator::class)->validate((string) $uri);
-                },
-            ],
-        ];
+        return extension_loaded('curl');
     }
 }

src/Imaging/RemoteUrlValidator.php

@@ -15,6 +15,39 @@ public function __construct(?callable $resolver = null)
     }
 
     public function parse($url)
+    {
+        $components = $this->validatedComponents($url);
+
+        return [
+            'path' => Str::after($components['path'], '/'),
+            'base' => $components['scheme'].'://'.$components['host'].$components['port_suffix'],
+            'query' => $components['query'],
+        ];
+    }
+
+    public function validate($url)
+    {
+        $this->parse($url);
+    }
+
+    /**
+     * Resolve and validate the URL host, returning the host, port, and the
+     * validated public IPs it resolves to. These IPs are intended to be pinned
+     * to the actual connection so the host cannot be rebound to an internal
+     * address between this check and the request being made.
+     */
+    public function resolve($url)
+    {
+        $components = $this->validatedComponents($url);
+
+        return [
+            'host' => $components['host'],
+            'port' => $components['port'],
+            'ips' => $components['ips'],
+        ];
+    }
+
+    protected function validatedComponents($url)
     {
         $parsed = parse_url($url);
 
@@ -48,22 +81,19 @@ public function parse($url)
             throw new InvalidRemoteUrlException('Invalid URL host.');
         }
 
-        $this->ensureHostResolvesToPublicIps($host);
-
-        $port = isset($parsed['port']) ? ':'.$parsed['port'] : '';
+        $ips = $this->ensureHostResolvesToPublicIps($host);
 
         return [
-            'path' => Str::after($parsed['path'] ?? '/', '/'),
-            'base' => $scheme.'://'.$host.$port,
+            'scheme' => $scheme,
+            'host' => $host,
+            'port' => $parsed['port'] ?? ($scheme === 'https' ? 443 : 80),
+            'port_suffix' => isset($parsed['port']) ? ':'.$parsed['port'] : '',
+            'path' => $parsed['path'] ?? '/',
             'query' => $parsed['query'] ?? null,
+            'ips' => $ips,
         ];
     }
 
-    public function validate($url)
-    {
-        $this->parse($url);
-    }
-
     protected function isValidHost($host)
     {
         return filter_var($host, FILTER_VALIDATE_IP)
@@ -75,7 +105,7 @@ protected function ensureHostResolvesToPublicIps($host)
         if (filter_var($host, FILTER_VALIDATE_IP)) {
             $this->assertPublicIp($host);
 
-            return;
+            return [$host];
         }
 
         $records = call_user_func($this->resolver, $host);
@@ -90,6 +120,8 @@ protected function ensureHostResolvesToPublicIps($host)
         foreach ($ips as $ip) {
             $this->assertPublicIp($ip);
         }
+
+        return $ips;
     }
 
     protected function assertPublicIp($ip)

tests/Forms/CsvExporterTest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Tests\Forms;
+
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Facades\Blueprint;
+use Statamic\Facades\Form;
+use Statamic\Facades\FormSubmission;
+use Statamic\Forms\Exporters\CsvExporter;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+
+class CsvExporterTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk;
+
+    #[Test]
+    public function it_neutralizes_formula_injection_in_submission_values()
+    {
+        $blueprint = Blueprint::makeFromFields(['name' => ['type' => 'text']]);
+        Blueprint::shouldReceive('find')->with('forms.test')->andReturn($blueprint);
+
+        $form = tap(Form::make('test'))->save();
+        FormSubmission::make()->form($form)->data(['name' => '=1+1'])->save();
+
+        $csv = (new CsvExporter)->setForm($form)->setConfig([])->export();
+
+        $this->assertStringContainsString('\'=1+1', $csv);
+        $this->assertStringNotContainsString('"=1+1', $csv);
+    }
+}