[YvesCesar]

Summary

xdebug.ini enabled xdebug.discover_client_host together with start_with_request=yes. With XDEBUG_MODE=debug, every request made Xdebug open its debugger connection to the address taken from the request (X-Forwarded-For or REMOTE_ADDR) instead of the configured client_host. Anyone able to send a request to the environment could choose where the debugger session goes and receive a DBGp session, which allows evaluating arbitrary PHP in the container.

This removes xdebug.discover_client_host. Xdebug now always connects to client_host=host.docker.internal, which the compose file already maps to the host gateway, so the documented IDE setup keeps working. XDEBUG_CONFIG can still override client_host.

Validation

• New policy test in tests/proxy/compose-policy.bats fails on main and passes with this change; the rest of the file still passes.
• With the published PHP 8.3 image and XDEBUG_MODE=debug, a request carrying X-Forwarded-For pointing to another container made Xdebug connect to that container on main; with this xdebug.ini mounted, no connection was made.