Edorian

An issue exists where arbitrary files can be read if the `FileLoader::findTemplate()` function is supplied with un-validated user controlled data.

The `unserialize` filter lacks restrictions on allowed classes, which can be utilized as a deserialization remote-code-execution gadget. Deserialization is the process of converting a stored data format back into an object, and a gadget is a piece of code within a library that can be leveraged to achieve an unintended effect during this process.

The MailPreview feature in `src/Controller/MailPreviewController.php` fails to properly validate the `previewName` value in the `findPreview()` function. The application passes the resolved class from `App::className()` to constructor execution without rejecting namespace separators or verifying that the class extends `DebugKitMailerMailPreview`. An attacker with access to DebugKit, provided debug mode is enabled and the request hostname is local or allowlisted, can select an unintended application class via the mail-preview preview route. This leads to arbitrary constructor execution and limited disclosure of application information.

Insufficient escaping of parsed JMESPath function names into generated PHP source allows for the generation and execution of attacker-controlled PHP code. This occurs when `JmesPathCompilerRuntime` is used with a crafted JMESPath expression, causing the generated cache file to contain executable code that is subsequently loaded by the compiler runtime.

Improper Host header validation occurs when parsing raw HTTP request messages or deriving a server request URI from server variables. An attacker can provide a malformed Host header containing URI authority delimiters, such as `trusted.example@evil.example`. When this value is used to construct a URI, it can be reinterpreted as URI userinfo and host, causing the resulting request URI host to differ from the original Host header. This affects applications using the `GuzzleHttpPsr7Message::parseRequest()` function, the legacy `GuzzleHttpPsr7parse request()` function, or those building server requests from attacker-controlled server variables that rely on the URI host for routing, allow-list checks, or forwarding. In gateway or forwarding scenarios, this may lead to requests or credentials being sent to an unintended host.

The library fails to reject ASCII control characters, whitespace, or DEL in first-party URI host components. When an application uses a user-controlled URL to construct a PSR-7 `Uri` or `Request` without an explicit `Host` header, the host component containing CRLF or other header-unsafe characters is copied into the `Host` header. If the HTTP client does not independently reject the malformed host, an attacker can inject additional attacker-controlled header lines. This can lead to request smuggling or cache poisoning in environments using HTTP/1.1 connection reuse, proxies, gateways, or load balancers. This issue affects applications performing outbound HTTP requests, URL forwarding, proxying, crawling, or webhook delivery.