From f74db527d55312c6c7066ff4d9bb0e29459f99aa Mon Sep 17 00:00:00 2001
From: Alejandro Estringana Ruiz <alejandro.estringanaruiz@datadoghq.com>
Date: Fri, 3 Jan 2025 18:03:37 +0100
Subject: [PATCH] Enable SSRF tests for PHP

---
 manifests/php.yml                           | 13 ++++++++++++-
 utils/build/docker/php/common/rasp/ssrf.php | 19 ++++++++++++++++++-
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/manifests/php.yml b/manifests/php.yml
index 034c701885..399aee7184 100644
--- a/manifests/php.yml
+++ b/manifests/php.yml
@@ -152,7 +152,18 @@ tests/:
       test_lfi.py: missing_feature
       test_shi.py: missing_feature
       test_sqli.py: missing_feature
-      test_ssrf.py: missing_feature
+      test_ssrf.py:
+        Test_Ssrf_BodyJson: v1.6.0
+        Test_Ssrf_BodyUrlEncoded: v1.6.0
+        Test_Ssrf_BodyXml: v1.6.0
+        Test_Ssrf_Capability: v1.6.0
+        Test_Ssrf_Mandatory_SpanTags: v1.6.0
+        Test_Ssrf_Optional_SpanTags: v1.6.0
+        Test_Ssrf_Rules_Version: v1.6.0
+        Test_Ssrf_StackTrace: v1.6.0
+        Test_Ssrf_Telemetry: v1.6.0
+        Test_Ssrf_UrlQuery: v1.6.0
+        Test_Ssrf_Waf_Version: v1.6.0
     waf/:
       test_addresses.py:
         Test_BodyJson: v0.98.1 # TODO what is the earliest version?
diff --git a/utils/build/docker/php/common/rasp/ssrf.php b/utils/build/docker/php/common/rasp/ssrf.php
index d602f0bc81..f64ccf3eea 100644
--- a/utils/build/docker/php/common/rasp/ssrf.php
+++ b/utils/build/docker/php/common/rasp/ssrf.php
@@ -1 +1,18 @@
-<?php echo "Hello, SSRF!";
+<?php
+
+$domain = null;
+$contentType = $_SERVER['CONTENT_TYPE'] ?? "";
+switch ($contentType) {
+	case 'application/json':
+		$body = file_get_contents("php://input");
+		$decoded = json_decode($body, 1);
+		$domain = $decoded["domain"];
+		break;
+	default:
+		$domain = urldecode($_REQUEST["domain"]);
+		break;
+}
+
+file_get_contents($domain);
+
+echo "Hello, SSRF!";