Block curl to download from anything else than http or https.

Throw exception when download fails.

libraries/http_request.inc

@@ -150,41 +150,53 @@ function http_request_get($url, $username = NULL, $password = NULL, $accept_inva
   if ($curl) {
     $headers[] = 'User-Agent: Drupal (+http://drupal.org/)';
     $result = new stdClass();
-    $download = curl_init($url);
-    curl_setopt($download, CURLOPT_FOLLOWLOCATION, TRUE);
-    if (!empty($username)) {
-      curl_setopt($download, CURLOPT_USERPWD, "{$username}:{$password}");
-    }
-    curl_setopt($download, CURLOPT_HTTPHEADER, $headers);
-    curl_setopt($download, CURLOPT_HEADER, TRUE);
-    curl_setopt($download, CURLOPT_RETURNTRANSFER, TRUE);
-    curl_setopt($download, CURLOPT_ENCODING, '');
-    if ($accept_invalid_cert) {
-      curl_setopt($download, CURLOPT_SSL_VERIFYPEER, 0);
+
+    // Only download via cURL if we can validate the scheme to be either http or
+    // https.
+    // Validate in PHP, CURLOPT_PROTOCOLS is only supported with cURL 7.19.4
+    $uri = parse_url($url);
+    if ($uri['scheme'] != 'http' && $uri['scheme'] != 'https') {
+      $result->error = 'invalid schema '. $uri['scheme'];
+      $result->code = -1003; // This corresponds to drupal_http_request()
     }
-    $header = '';
-    $data = curl_exec($download);
-    $header_size = curl_getinfo($download, CURLINFO_HEADER_SIZE);
-    $header = substr($data, 0, $header_size - 1);
-    $result->data = substr($data, $header_size);
-    $header_lines = preg_split("/\r\n|\n|\r/", $header);
-
-    $result->headers = array();
-    array_shift($header_lines); // skip HTTP response status
-    while ($line = trim(array_shift($header_lines))) {
-      list($header, $value) = explode(':', $line, 2);
-      if (isset($result->headers[$header]) && $header == 'Set-Cookie') {
-        // RFC 2109: the Set-Cookie response header comprises the token Set-
-        // Cookie:, followed by a comma-separated list of one or more cookies.
-        $result->headers[$header] .= ','. trim($value);
+    else {
+
+      $download = curl_init($url);
+      curl_setopt($download, CURLOPT_FOLLOWLOCATION, TRUE);
+      if (!empty($username)) {
+        curl_setopt($download, CURLOPT_USERPWD, "{$username}:{$password}");
       }
-      else {
-        $result->headers[$header] = trim($value);
+      curl_setopt($download, CURLOPT_HTTPHEADER, $headers);
+      curl_setopt($download, CURLOPT_HEADER, TRUE);
+      curl_setopt($download, CURLOPT_RETURNTRANSFER, TRUE);
+      curl_setopt($download, CURLOPT_ENCODING, '');
+      if ($accept_invalid_cert) {
+        curl_setopt($download, CURLOPT_SSL_VERIFYPEER, 0);
       }
-    }
-    $result->code = curl_getinfo($download, CURLINFO_HTTP_CODE);
+      $header = '';
+      $data = curl_exec($download);
+      $header_size = curl_getinfo($download, CURLINFO_HEADER_SIZE);
+      $header = substr($data, 0, $header_size - 1);
+      $result->data = substr($data, $header_size);
+      $header_lines = preg_split("/\r\n|\n|\r/", $header);
+
+      $result->headers = array();
+      array_shift($header_lines); // skip HTTP response status
+      while ($line = trim(array_shift($header_lines))) {
+        list($header, $value) = explode(':', $line, 2);
+        if (isset($result->headers[$header]) && $header == 'Set-Cookie') {
+          // RFC 2109: the Set-Cookie response header comprises the token Set-
+          // Cookie:, followed by a comma-separated list of one or more cookies.
+          $result->headers[$header] .= ','. trim($value);
+        }
+        else {
+          $result->headers[$header] = trim($value);
+        }
+      }
+      $result->code = curl_getinfo($download, CURLINFO_HTTP_CODE);
 
-    curl_close($download);
+      curl_close($download);
+    }
   }
   else {
     $result = drupal_http_request($url, $headers);

plugins/FeedsHTTPFetcher.inc

@@ -31,6 +31,9 @@ class FeedsHTTPFetcher extends FeedsFetcher {
     else {
       $result = http_request_get($url);
     }
+    if ($result->code != 200) {
+      throw new Exception(t('Download of @url failed with code !code.', array('@url' => $url, '!code' => $result->code)));
+    }
     return new FeedsFetcherResult($result->data, 'text/xml');
   }