fix: centralize safe remote imports for SSRF (#1336)

Author: Soare-Robert-Daniel

classes/Visualizer/Module/AIBuilder.php

@@ -206,7 +206,7 @@ public function fetchChart(): void {
 	/**
 	 * Determines whether a remote URL serves an XLSX file.
 	 *
-	 * Uses wp_safe_remote_get() and checks ZIP magic number (PK\x03\x04).
+	 * Uses the shared remote-fetch policy and checks ZIP magic number (PK\x03\x04).
 	 *
 	 * @access private
 	 * @param string $url The remote URL to probe.
@@ -218,14 +218,15 @@ private static function _url_is_xlsx( $url ) {
 			return false;
 		}
 
-		$response = wp_safe_remote_get(
+		$response = Visualizer_Remote_Fetch::request(
 			$url,
 			array(
-				'timeout'     => 15,
-				'redirection' => 5,
-				'stream'      => true,
-				'filename'    => $tmpfile,
-				'headers'     => array( 'Range' => 'bytes=0-3' ),
+				'timeout'             => 15,
+				'redirection'         => 5,
+				'stream'              => true,
+				'filename'            => $tmpfile,
+				'headers'             => array( 'Range' => 'bytes=0-3' ),
+				'limit_response_size' => 4,
 			)
 		);
 

classes/Visualizer/Module/Chart.php

@@ -204,7 +204,8 @@ public function getJsonData() {
 
 		$chart_id = $params['chart'];
 
-		if ( empty( $chart_id ) ) {
+		$chart = $chart_id ? get_post( $chart_id ) : null;
+		if ( ! $chart || Visualizer_Plugin::CPT_VISUALIZER !== $chart->post_type || ! current_user_can( 'edit_post', $chart_id ) ) {
 			wp_die();
 		}
 
@@ -1037,7 +1038,7 @@ public function renderFlattrScript() {
 	 * Used as a fallback when the URL path has no recognisable file extension
 	 * (e.g. SharePoint, signed S3 URLs, or "download?id=…" endpoints).
 	 *
-	 * Uses wp_safe_remote_get() to block requests to private/loopback addresses,
+	 * Uses the shared remote-fetch policy to block non-public destinations,
 	 * and streams the response to a temp file so no body data is held in memory
 	 * regardless of whether the server honours the Range header.
 	 *
@@ -1056,14 +1057,15 @@ private static function _url_is_xlsx( $url ) {
 			return false;
 		}
 
-		$response = wp_safe_remote_get(
+		$response = Visualizer_Remote_Fetch::request(
 			$url,
 			array(
-				'timeout'    => 10,
-				'user-agent' => 'WordPress/' . get_bloginfo( 'version' ),
-				'headers'    => array( 'Range' => 'bytes=0-3' ),
-				'stream'     => true,
-				'filename'   => $tmpfile,
+				'timeout'             => 10,
+				'user-agent'          => 'WordPress/' . get_bloginfo( 'version' ),
+				'headers'             => array( 'Range' => 'bytes=0-3' ),
+				'stream'              => true,
+				'filename'            => $tmpfile,
+				'limit_response_size' => 4,
 			)
 		);