Fix SSRF bypass of trusted_uri in {fetch} (PT-03-2026)

changelog/ssrf-pt-03-2026.md

@@ -0,0 +1 @@
+- Security: prevent SSRF bypass of `trusted_uri` via redirect-following in `{fetch}`. When a security policy is active, the HTTP stream wrapper no longer auto-follows redirects, so an Open Redirect on a trusted host can no longer be used to reach arbitrary URIs. Reported by Aleksey Solovev (Positive Technologies), PT-03-2026.

src/FunctionHandler/Fetch.php

@@ -189,7 +189,19 @@ public function handle($params, Template $template) {
 				return;
 			}
 		} else {
-			$content = @file_get_contents($params['file']);
+			$context = null;
+			if (isset($template->getSmarty()->security_policy)) {
+				// When a security policy is active, the trusted_uri check only validates
+				// the URL passed to {fetch}. PHP's HTTP stream wrapper follows redirects
+				// by default, which would let an Open Redirect on a trusted host bypass
+				// the policy and reach arbitrary internal addresses (SSRF). Disable
+				// redirect following for the policy-checked request. See PT-03-2026.
+				$context = stream_context_create([
+					'http'  => ['follow_location' => 0, 'max_redirects' => 1],
+					'https' => ['follow_location' => 0, 'max_redirects' => 1],
+				]);
+			}
+			$content = @file_get_contents($params['file'], false, $context);
 			if ($content === false) {
 				throw new Exception("{fetch} cannot read resource '" . $params['file'] . "'");
 			}