From 2b3d566b4aa36c35a4cf5db9d5c11c476ea4edad Mon Sep 17 00:00:00 2001
From: Alejandro Estringana Ruiz <alejandro.estringanaruiz@datadoghq.com>
Date: Fri, 3 Jan 2025 18:03:37 +0100
Subject: [PATCH 1/3] Enable SSRF tests for PHP

---
 utils/build/docker/php/common/php.ini       |  1 +
 utils/build/docker/php/common/rasp/ssrf.php | 24 ++++++++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/utils/build/docker/php/common/php.ini b/utils/build/docker/php/common/php.ini
index 0b5d91ee3b..83d41153e6 100644
--- a/utils/build/docker/php/common/php.ini
+++ b/utils/build/docker/php/common/php.ini
@@ -10,6 +10,7 @@ extension=mysqli.so
 extension=pdo.so
 extension=pdo_mysql.so
 extension=pdo_pgsql.so
+extension=simplexml.so
 error_log=/var/log/system-tests/php_error.log
 error_reporting=2147483647
 display_errors=0
diff --git a/utils/build/docker/php/common/rasp/ssrf.php b/utils/build/docker/php/common/rasp/ssrf.php
index d602f0bc81..346486685f 100644
--- a/utils/build/docker/php/common/rasp/ssrf.php
+++ b/utils/build/docker/php/common/rasp/ssrf.php
@@ -1 +1,23 @@
-<?php echo "Hello, SSRF!";
+<?php
+
+$domain = null;
+$contentType = $_SERVER['CONTENT_TYPE'] ?? "";
+switch ($contentType) {
+	case 'application/json':
+		$body = file_get_contents("php://input");
+		$decoded = json_decode($body, 1);
+		$domain = $decoded["domain"];
+		break;
+	case 'application/xml':
+		$body = file_get_contents("php://input");
+		$decoded = simplexml_load_string(stripslashes($body));
+		$domain = (string)$decoded[0];
+		break;
+	default:
+		$domain = urldecode($_REQUEST["domain"]);
+		break;
+}
+
+file_get_contents('http://'.$domain);
+
+echo "Hello, SSRF!";

From 79f204f7b1bd3aa9440cdfa9a303e8afda734de6 Mon Sep 17 00:00:00 2001
From: Alejandro Estringana Ruiz <alejandro.estringanaruiz@datadoghq.com>
Date: Fri, 24 Jan 2025 18:07:40 +0100
Subject: [PATCH 2/3] Set ssrf test versions

---
 manifests/php.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/manifests/php.yml b/manifests/php.yml
index c270c562e9..573a539013 100644
--- a/manifests/php.yml
+++ b/manifests/php.yml
@@ -205,16 +205,16 @@ tests/:
         Test_Sqli_UrlQuery: missing_feature
         Test_Sqli_Waf_Version:  v1.6.2
       test_ssrf.py:
-        Test_Ssrf_BodyJson: missing_feature
-        Test_Ssrf_BodyUrlEncoded: missing_feature
-        Test_Ssrf_BodyXml: missing_feature
-        Test_Ssrf_Capability: missing_feature
-        Test_Ssrf_Mandatory_SpanTags: missing_feature
-        Test_Ssrf_Optional_SpanTags: missing_feature
+        Test_Ssrf_BodyJson: v1.6.3
+        Test_Ssrf_BodyUrlEncoded: v1.6.3
+        Test_Ssrf_BodyXml: v1.6.3
+        Test_Ssrf_Capability: v1.6.3
+        Test_Ssrf_Mandatory_SpanTags: v1.6.3
+        Test_Ssrf_Optional_SpanTags: v1.6.3
         Test_Ssrf_Rules_Version:  v1.6.2
-        Test_Ssrf_StackTrace: missing_feature
+        Test_Ssrf_StackTrace: v1.6.3
         Test_Ssrf_Telemetry: missing_feature
-        Test_Ssrf_UrlQuery: missing_feature
+        Test_Ssrf_UrlQuery: v1.6.3
         Test_Ssrf_Waf_Version:  v1.6.2
     waf/:
       test_addresses.py:

From 14a62c8c440a1ab4eb37cccecb3a2e0546805881 Mon Sep 17 00:00:00 2001
From: Alejandro Estringana Ruiz <alejandro.estringanaruiz@datadoghq.com>
Date: Thu, 30 Jan 2025 11:15:54 +0100
Subject: [PATCH 3/3] Set right version

---
 manifests/php.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/manifests/php.yml b/manifests/php.yml
index 573a539013..bd7c4382f0 100644
--- a/manifests/php.yml
+++ b/manifests/php.yml
@@ -205,17 +205,17 @@ tests/:
         Test_Sqli_UrlQuery: missing_feature
         Test_Sqli_Waf_Version:  v1.6.2
       test_ssrf.py:
-        Test_Ssrf_BodyJson: v1.6.3
-        Test_Ssrf_BodyUrlEncoded: v1.6.3
-        Test_Ssrf_BodyXml: v1.6.3
-        Test_Ssrf_Capability: v1.6.3
-        Test_Ssrf_Mandatory_SpanTags: v1.6.3
-        Test_Ssrf_Optional_SpanTags: v1.6.3
-        Test_Ssrf_Rules_Version:  v1.6.2
-        Test_Ssrf_StackTrace: v1.6.3
+        Test_Ssrf_BodyJson: v1.7.0
+        Test_Ssrf_BodyUrlEncoded: v1.7.0
+        Test_Ssrf_BodyXml: v1.7.0
+        Test_Ssrf_Capability: v1.7.0
+        Test_Ssrf_Mandatory_SpanTags: v1.7.0
+        Test_Ssrf_Optional_SpanTags: v1.7.0
+        Test_Ssrf_Rules_Version: v1.7.0
+        Test_Ssrf_StackTrace: v1.7.0
         Test_Ssrf_Telemetry: missing_feature
-        Test_Ssrf_UrlQuery: v1.6.3
-        Test_Ssrf_Waf_Version:  v1.6.2
+        Test_Ssrf_UrlQuery: v1.7.0
+        Test_Ssrf_Waf_Version: v1.7.0
     waf/:
       test_addresses.py:
         Test_BodyJson: v0.98.1 # TODO what is the earliest version?