CurlRedirectForwardsCredentials

warning native off by default

Group: Security

Unrestricted authentication can forward credentials across redirected hosts. Keep credential forwarding within an explicit trusted redirect policy. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
$h=curl_init();curl_setopt($h,CURLOPT_FOLLOWLOCATION,true);curl_setopt($h,CURLOPT_UNRESTRICTED_AUTH,true);curl_setopt($h,CURLOPT_USERPWD,"user:secret");curl_exec($h);

Reported:

• line 2: Restrict credential forwarding across redirects.

Detection

• Same resolved curl handle enables CURLOPT_FOLLOWLOCATION and CURLOPT_UNRESTRICTED_AUTH and configures CURLOPT_USERPWD to a known nonempty string before execution. Empty or unknown credentials do not establish a finding. Highlight unrestricted-auth option; unknown URL does not excuse enabled credential forwarding.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "CurlRedirectForwardsCredentials": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CurlRedirectForwardsCredentials