1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
From: Christian Flothmann <christian.flothmann@sensiolabs.de>
Date: Thu, 13 Sep 2018 19:04:50 +0200
Subject: [Security\Http] detect bad redirect targets using backslashes
[CVE-2018-19790] https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-when-using-security-http
Origin: upstream, https://github.com/symfony/symfony/commit/99a0cec0a6be39ce5ef38386e57339603b33ee5b
---
src/Symfony/Component/Security/Http/HttpUtils.php | 2 +-
.../Component/Security/Http/Tests/HttpUtilsTest.php | 18 ++++++++++++++++--
2 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/src/Symfony/Component/Security/Http/HttpUtils.php b/src/Symfony/Component/Security/Http/HttpUtils.php
index adfac12..e83b192 100644
--- a/src/Symfony/Component/Security/Http/HttpUtils.php
+++ b/src/Symfony/Component/Security/Http/HttpUtils.php
@@ -61,7 +61,7 @@ class HttpUtils
*/
public function createRedirectResponse(Request $request, $path, $status = 302)
{
- if (null !== $this->domainRegexp && preg_match('#^https?://[^/]++#i', $path, $host) && !preg_match(sprintf($this->domainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
+ if (null !== $this->domainRegexp && preg_match('#^https?:[/\\\\]{2,}+[^/]++#i', $path, $host) && !preg_match(sprintf($this->domainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
$path = '/';
}
diff --git a/src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php b/src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php
index 93be3cf..eb5fa65 100644
--- a/src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php
+++ b/src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php
@@ -53,14 +53,28 @@ class HttpUtilsTest extends \PHPUnit_Framework_TestCase
$this->assertTrue($response->isRedirect('http://localhost/blog'));
}
- public function testCreateRedirectResponseWithBadRequestsDomain()
+ /**
+ * @dataProvider badRequestDomainUrls
+ */
+ public function testCreateRedirectResponseWithBadRequestsDomain($url)
{
$utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');
- $response = $utils->createRedirectResponse($this->getRequest(), 'http://pirate.net/foo');
+ $response = $utils->createRedirectResponse($this->getRequest(), $url);
$this->assertTrue($response->isRedirect('http://localhost/'));
}
+ public function badRequestDomainUrls()
+ {
+ return array(
+ array('http://pirate.net/foo'),
+ array('http:\\\\pirate.net/foo'),
+ array('http:/\\pirate.net/foo'),
+ array('http:\\/pirate.net/foo'),
+ array('http://////pirate.net/foo'),
+ );
+ }
+
public function testCreateRedirectResponseWithProtocolRelativeTarget()
{
$utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');
|
