🌐 AI搜索 & 代理 主页
Skip to content

Commit cd205e4

Browse files
nicolas-grekasnicolas-grekas
committed
bug #62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (nicolas-grekas)
This PR was merged into the 6.4 branch. Discussion ---------- [HttpFoundation] Fix parsing hosts and schemes in URLs | Q | A | ------------- | --- | Branch? | 6.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | - | License | MIT This PR implements stricter parsing of URL hosts and schemes. It hardens the codebase by making our interpretation or URLs closer to [the spec](https://url.spec.whatwg.org/). This should help close potential semantic gaps between different layers of infrastructure. The robustness principle is dead. This topic has been raised by `@zer0yu` `@P3ngu1nW` `@9vvert` - thanks to them! Commits ------- 8302e52 [HttpFoundation] Fix parsing hosts and schemes in URLs
2 parents 4116def + 8302e52 commit cd205e4

File tree

3 files changed

+99
-17
lines changed

3 files changed

+99
-17
lines changed

‎src/Symfony/Component/HttpFoundation/Request.php‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -351,10 +351,21 @@ public static function create(string $uri, string $method = 'GET', array $parame
351351
$server['PATH_INFO'] = '';
352352
$server['REQUEST_METHOD'] = strtoupper($method);
353353

354+
if (($i = strcspn($uri, ':/?#')) && ':' === ($uri[$i] ?? null) && (strspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-.') !== $i || strcspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'))) {
355+
throw new BadRequestException('Invalid URI: Scheme is malformed.');
356+
}
354357
if (false === $components = parse_url(\strlen($uri) !== strcspn($uri, '?#') ? $uri : $uri.'#')) {
355358
throw new BadRequestException('Invalid URI.');
356359
}
357360

361+
$part = ($components['user'] ?? '').':'.($components['pass'] ?? '');
362+
363+
if (':' !== $part && \strlen($part) !== strcspn($part, '[]')) {
364+
throw new BadRequestException('Invalid URI: Userinfo is malformed.');
365+
}
366+
if (($part = $components['host'] ?? '') && !self::isHostValid($part)) {
367+
throw new BadRequestException('Invalid URI: Host is malformed.');
368+
}
358369
if (false !== ($i = strpos($uri, '\\')) && $i < strcspn($uri, '?#')) {
359370
throw new BadRequestException('Invalid URI: A URI cannot contain a backslash.');
360371
}
@@ -1151,10 +1162,8 @@ public function getHost(): string
11511162
// host is lowercase as per RFC 952/2181
11521163
$host = strtolower(preg_replace('/:\d+$/', '', trim($host)));
11531164

1154-
// as the host can come from the user (HTTP_HOST and depending on the configuration, SERVER_NAME too can come from the user)
1155-
// check that it does not contain forbidden characters (see RFC 952 and RFC 2181)
1156-
// use preg_replace() instead of preg_match() to prevent DoS attacks with long host names
1157-
if ($host && '' !== preg_replace('/(?:^\[)?[a-zA-Z0-9-:\]_]+\.?/', '', $host)) {
1165+
// the host can come from the user (HTTP_HOST and depending on the configuration, SERVER_NAME too can come from the user)
1166+
if ($host && !self::isHostValid($host)) {
11581167
if (!$this->isHostValid) {
11591168
return '';
11601169
}
@@ -2135,4 +2144,21 @@ private function isIisRewrite(): bool
21352144

21362145
return $this->isIisRewrite;
21372146
}
2147+
2148+
/**
2149+
* See https://url.spec.whatwg.org/.
2150+
*/
2151+
private static function isHostValid(string $host): bool
2152+
{
2153+
if ('[' === $host[0]) {
2154+
return ']' === $host[-1] && filter_var(substr($host, 1, -1), \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6);
2155+
}
2156+
2157+
if (preg_match('/\.[0-9]++\.?$/D', $host)) {
2158+
return null !== filter_var($host, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4 | \FILTER_NULL_ON_FAILURE);
2159+
}
2160+
2161+
// use preg_replace() instead of preg_match() to prevent DoS attacks with long host names
2162+
return '' === preg_replace('/[-a-zA-Z0-9_]++\.?/', '', $host);
2163+
}
21382164
}

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php‎

Lines changed: 67 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2237,11 +2237,9 @@ public function testFactory()
22372237
Request::setFactory(null);
22382238
}
22392239

2240-
/**
2241-
* @dataProvider getLongHostNames
2242-
*/
2243-
public function testVeryLongHosts($host)
2240+
public function testVeryLongHosts()
22442241
{
2242+
$host = 'a'.str_repeat('.a', 40000);
22452243
$start = microtime(true);
22462244

22472245
$request = Request::create('/');
@@ -2284,14 +2282,6 @@ public static function getHostValidities()
22842282
];
22852283
}
22862284

2287-
public static function getLongHostNames()
2288-
{
2289-
return [
2290-
['a'.str_repeat('.a', 40000)],
2291-
[str_repeat(':', 101)],
2292-
];
2293-
}
2294-
22952285
/**
22962286
* @dataProvider methodIdempotentProvider
22972287
*/
@@ -2667,6 +2657,71 @@ public function testReservedFlags()
26672657
$this->assertNotSame(0b10000000, $value, \sprintf('The constant "%s" should not use the reserved value "0b10000000".', $constant));
26682658
}
26692659
}
2660+
2661+
/**
2662+
* @dataProvider provideMalformedUrls
2663+
*/
2664+
public function testMalformedUrls(string $url, string $expectedException)
2665+
{
2666+
$this->expectException(BadRequestException::class);
2667+
$this->expectExceptionMessage($expectedException);
2668+
2669+
Request::create($url);
2670+
}
2671+
2672+
public static function provideMalformedUrls(): array
2673+
{
2674+
return [
2675+
['http://normal.com[@vulndetector.com/', 'Invalid URI: Userinfo is malformed.'],
2676+
['http://[normal.com@vulndetector.com/', 'Invalid URI: Userinfo is malformed.'],
2677+
['http://normal.com@[vulndetector.com/', 'Invalid URI: Host is malformed.'],
2678+
['http://[[normal.com@][vulndetector.com/', 'Invalid URI: Userinfo is malformed.'],
2679+
['http://[vulndetector.com]', 'Invalid URI: Host is malformed.'],
2680+
['http://[0:0::vulndetector.com]:80', 'Invalid URI: Host is malformed.'],
2681+
['http://[2001:db8::vulndetector.com]', 'Invalid URI: Host is malformed.'],
2682+
['http://[malicious.com]', 'Invalid URI: Host is malformed.'],
2683+
['http://[evil.org]', 'Invalid URI: Host is malformed.'],
2684+
['http://[internal.server]', 'Invalid URI: Host is malformed.'],
2685+
['http://[192.168.1.1]', 'Invalid URI: Host is malformed.'],
2686+
['http://192.abc.1.1', 'Invalid URI: Host is malformed.'],
2687+
['http://[localhost]', 'Invalid URI: Host is malformed.'],
2688+
["\x80https://example.com", 'Invalid URI: Scheme is malformed.'],
2689+
['>https://example.com', 'Invalid URI: Scheme is malformed.'],
2690+
["http\x0b://example.com", 'Invalid URI: Scheme is malformed.'],
2691+
["https\x80://example.com", 'Invalid URI: Scheme is malformed.'],
2692+
['http>://example.com', 'Invalid URI: Scheme is malformed.'],
2693+
['0http://example.com', 'Invalid URI: Scheme is malformed.'],
2694+
];
2695+
}
2696+
2697+
/**
2698+
* @dataProvider provideLegitimateUrls
2699+
*/
2700+
public function testLegitimateUrls(string $url)
2701+
{
2702+
$request = Request::create($url);
2703+
2704+
$this->assertInstanceOf(Request::class, $request);
2705+
}
2706+
2707+
public static function provideLegitimateUrls(): array
2708+
{
2709+
return [
2710+
['http://example.com'],
2711+
['https://example.com'],
2712+
['http://example.com:8080'],
2713+
['https://example.com:8443'],
2714+
['http://user:pass@example.com'],
2715+
['http://user:pass@example.com:8080'],
2716+
['http://user:pass@example.com/path'],
2717+
['http://[2001:db8::1]'],
2718+
['http://[2001:db8::1]:8080'],
2719+
['http://[2001:db8::1]/path'],
2720+
['http://[::1]'],
2721+
['http://example.com/path'],
2722+
[':path'],
2723+
];
2724+
}
26702725
}
26712726

26722727
class RequestContentProxy extends Request

‎src/Symfony/Component/HttpKernel/Tests/EventListener/RouterListenerTest.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,8 @@ public function testRequestWithBadHost()
205205
{
206206
$this->expectException(BadRequestHttpException::class);
207207
$kernel = $this->createMock(HttpKernelInterface::class);
208-
$request = Request::create('http://bad host %22/');
208+
$request = Request::create('/');
209+
$request->headers->set('host', 'bad host %22');
209210
$event = new RequestEvent($kernel, $request, HttpKernelInterface::MAIN_REQUEST);
210211

211212
$requestMatcher = $this->createMock(RequestMatcherInterface::class);

0 commit comments

Comments
 (0)