false, 'error' => $attachment_id->get_error_message(), ); } $this->set_alt_text( $attachment_id, $alt ); return $this->format_attachment( $attachment_id ); } /** * Download a remote image and add it to the media library. * * @param string $url Remote image URL. * @param string $filename Optional filename override. * @param int $post_id Optional parent post ID. * @return array */ public function sideload_from_url( $url, $filename = '', $post_id = 0, $alt = '' ) { require_once ABSPATH . 'wp-admin/includes/file.php'; require_once ABSPATH . 'wp-admin/includes/image.php'; require_once ABSPATH . 'wp-admin/includes/media.php'; // SSRF guard: only http/https + reject loopback / link-local / RFC1918 // before letting WP fetch anything. We're not a generic URL proxy — // legitimate cover images always live on a public CDN. // // The guard returns the validated IP. We pin curl to that IP via // CURLOPT_RESOLVE so the actual TCP connection cannot be hijacked by a // DNS-rebinding attacker who served a public IP at validation time and // flips the record to 169.254.169.254 (or 10.x) before the fetch. $guard = self::guard_remote_url( $url ); if ( is_wp_error( $guard ) ) { return array( 'success' => false, 'error' => $guard->get_error_message(), ); } $pinned_ip = $guard; // Download with a curl handle that pins host -> $pinned_ip. Redirects // are disabled because a 3xx response could relocate the fetch to a // private IP (rebinding via Location header). $tmp_file = self::download_pinned( $url, $pinned_ip, 30 ); if ( is_wp_error( $tmp_file ) ) { return array( 'success' => false, 'error' => 'Failed to download image: ' . $tmp_file->get_error_message(), ); } // Reject SVG/XML payloads regardless of how the URL extension was // spelled. WordPress doesn't sanitize SVG by default and serves it // inline as `image/svg+xml`, so a