Outsource SSRF mitigation implementation in dashboard to community

[mogul]

User Story

In order to maximize our chances of blocking SSRF attempts with minimal ongoing maintenance, the data.gov team wants to use a community-maintained PHP SSRF blocking solution in place of our own code.

Acceptance Criteria

• WHEN I grep for curl_exec() in a checkout of dashboard-app
  THEN I see no results outside the vendor directory other than safecurl_exec().
• WHEN I look at the source for filter_remote_url()
  THEN I see no bespoke code, only calls to safecurl.

Background

We have written our own SSRF mitigation code for the dashboard but we have found again and again that there are cases we haven't thought of. We should be teaming up with a community effort to reduce our risk and maintenance friction for the dashboard. The j0k3r PHP package looks the most maintained and used, but we know that it doesn't handle IPv6 addresses (whereas our existing implementation does).

Security Considerations (required)

This change will maintain the existing security profile due to existing tests that capture our expectations, and potentially improve our security due to more cases being blocked.

Sketch

• Bring in the j0k3r/safecurl library and use it in filter_remote_url() and the curl_*() api helper functions.
• Make a PR to the j0k3r/safecurl fork to implement the missing IPv6 filtering.

[nickumia-reisys]

• Deprecate the Dashboard #3502