CVE-2022-24739: Server-Side Request Forgery (SSRF) (CWE-918)
value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 6.1
Published: 2022-03-08T22:15Z
Repository: https://github.com/Rudloff/alltube
Language: PHP
Files changed: classes/Factory/ViewFactory.php, index.php, templates/inc/logo.tpl
Commit date: 2022-02-20 13:28:57 +0100
Commit message: Don't redirect to REQUEST_URI when browsing to index.php
Instead, we can make sure everything works correctly on index.php

Diff: diff --git a/classes/Factory/ViewFactory.php b/classes/Factory/ViewFactory.php
index 591369d..1b9fe6c 100644
--- a/classes/Factory/ViewFactory.php
+++ b/classes/Factory/ViewFactory.php
@@ -35,10 +35,29 @@ class ViewFactory
         return $uri->withBasePath('')
             ->withHost('alltubedownload.net')
             ->withScheme('https');
     }
 
+    /**
+     * @param Uri $uri
+     * @return Uri
+     */
+    private static function cleanBasePath(Uri $uri): Uri
+    {
+        $basePath = $uri->getBasePath();
+        if (str_ends_with($basePath, 'index.php')) {
+            /*
+             * When the base path ends with index.php,
+             * routing works correctly, but it breaks the URL of static assets using {base_url}.
+             * So we alter the base path but only in the URI used by SmartyPlugins.
+             */
+            $uri = $uri->withBasePath(dirname($basePath));
+        }
+
+        return $uri;
+    }
+
     /**
      * Create Smarty view object.
      *
      * @param ContainerInterface $container Slim dependency container
      * @param Request|null $request PSR-7 request
@@ -74,10 +93,12 @@ class ViewFactory
         }
 
         /** @var LocaleManager $localeManager */
         $localeManager = $container->get('locale');
 
+        $uri = self::cleanBasePath($uri);
+
         $smartyPlugins = new SmartyPlugins($container->get('router'), $uri->withUserInfo(''));
         $view->registerPlugin('function', 'path_for', [$smartyPlugins, 'pathFor']);
         $view->registerPlugin('function', 'base_url', [$smartyPlugins, 'baseUrl']);
         $view->registerPlugin('block', 't', [$localeManager, 'smartyTranslate']);
 
diff --git a/index.php b/index.php
index 112fb7d..0ca2302 100644
--- a/index.php
+++ b/index.php
@@ -3,15 +3,10 @@
 require_once __DIR__ . '/vendor/autoload.php';
 
 use Alltube\App;
 use Alltube\ErrorHandler;
 
-if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
-    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
-    die;
-}
-
 try {
     // Create app.
     $app = new App();
 
     $app->run();
diff --git a/templates/inc/logo.tpl b/templates/inc/logo.tpl
index b1da44f..47b70b3 100644
--- a/templates/inc/logo.tpl
+++ b/templates/inc/logo.tpl
@@ -1,5 +1,5 @@
 <h1 class="logobis">
-    <a class="logocompatible" href="{base_url}">
+    <a class="logocompatible" href="{path_for name="index"}">
         <span class="logocompatiblemask"><img src="{base_url}/img/logocompatiblemask.png" width="447" height="107"
                                               alt="{$config->appName}"/></span>
     </a></h1>

Vulnerable code: if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
    die;
}

    <a class="logocompatible" href="{base_url}">
Fixed code:     /**
     * @param Uri $uri
     * @return Uri
     */
    private static function cleanBasePath(Uri $uri): Uri
    {
        $basePath = $uri->getBasePath();
        if (str_ends_with($basePath, 'index.php')) {
            /*
             * When the base path ends with index.php,
             * routing works correctly, but it breaks the URL of static assets using {base_url}.
             * So we alter the base path but only in the URI used by SmartyPlugins.
             */
            $uri = $uri->withBasePath(dirname($basePath));
        }

        return $uri;
    }

        $uri = self::cleanBasePath($uri);

    <a class="logocompatible" href="{path_for name="index"}">