PHP proxy path parameter lacks validation — potential SSRF

[sgardoll]

Summary

The PHP proxy files (gemini-proxy.php, anthropic-proxy.php, openai-proxy.php) accept a path parameter from query string with minimal sanitization (only ltrim). No URL validation or allowlist prevents requests to unintended endpoints.

Risk Assessment

• Risk Level: Medium
• Likelihood: Low-Medium
• Impact: High — if deployed to production, could be used for SSRF
• Timeline: If deployed without additional security layer

Affected Code

gemini-proxy.php (line 7)

$path = $_GET['path'] ?? '';
$path = ltrim($path, '/');
// ...
$targetUrl = 'https://generativelanguage.googleapis.com/' . $path;

proxy-utils.php (line 60)

Headers are forwarded with a blocked list, but no validation of the target URL itself.

Suggested Fix

1. Validate $path against allowlist: /^v1(beta)?\/models\/[\w.-]+:(generateContent|streamGenerateContent)$/
2. Add rate limiting per IP
3. Validate path contains only expected characters: [a-zA-Z0-9/:\-.]