fix: fix security issue in ExternalHttpClient.php

[anupamme]

Summary

Fix high severity security issue in lib/Security/ExternalHttpClient.php.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	lib/Security/ExternalHttpClient.php:54
Assessment	Likely exploitable

Description: The ExternalHttpClient accepts Basic Authentication credentials and passes them to the HTTP client without explicitly enforcing HTTPS. While TLS verification is enabled ('verify' => true), if an HTTP URL is configured, credentials would be transmitted in cleartext. Basic Auth credentials are base64-encoded (not encrypted) and can be instantly decoded if intercepted.

Evidence

Exploitation scenario: An attacker with MITM network access could intercept HTTP requests if the application is configured to call an external API using http:// instead of https://.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• lib/Security/ExternalHttpClient.php

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: Protected endpoints reject unauthenticated requests

Regression test

<?php

use PHPUnit\Framework\TestCase;
use Security\ExternalHttpClient;

class ExternalHttpClientAuthenticationTest extends TestCase
{
    /**
     * Invariant: Protected endpoints must reject requests without valid authentication credentials
     * @dataProvider authPayloadProvider
     */
    public function testRejectsUnauthenticatedRequests(string $basicAuth, bool $shouldFail): void
    {
        $client = new ExternalHttpClient();
        
        // Test with HTTP URL - credentials must not be transmitted over cleartext
        $httpUrl = 'http://example.test/api/protected';
        
        if ($shouldFail) {
            $this->expectException(\InvalidArgumentException::class);
            $this->expectExceptionMessage('HTTPS required');
        }
        
        $result = $client->request('GET', $httpUrl, [], $basicAuth);
        
        if (!$shouldFail) {
            $this->assertNotNull($result);
        }
    }

    public function authPayloadProvider(): array
    {
        return [
            'missing credentials' => ['', true],
            'malformed token' => ['not_base64_compatible!', true],
            'valid credentials over HTTP' => ['admin:secretpass', true],
        ];
    }
}

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security

[Rello]

thank you