Prevent API injection or SSRF attack

[asika32764]

• HttpClient call another API
  • params should not concat to URI string
  • try use prepare() or escape
• Do not have any http params use to load filesystem path

$http->get('https://api.com/users/:id/posts', [ 'params' => [ 'id' => 123 ] ])

[asika32764]

See also

• https://symfony.com/doc/current/http_client.html#ssrf-server-side-request-forgery-handling
• https://symfony.com/doc/current/http_client.html#using-uri-templates