1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
From: Christian Flothmann <christian.flothmann@sensiolabs.de>
Date: Fri, 1 Sep 2017 09:13:50 +0200
Subject: prevent bundle readers from breaking out of paths
[CVE-2017-16654] https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths
Origin: upstream, https://github.com/symfony/symfony/commit/c8f9f916b4b93f5676fad46c664980935c7757ae
---
.../Component/Intl/Data/Bundle/Reader/JsonBundleReader.php | 5 +++++
.../Component/Intl/Data/Bundle/Reader/PhpBundleReader.php | 5 +++++
.../Data/Bundle/Reader/Fixtures/invalid_directory/en.json | 1 +
.../Data/Bundle/Reader/Fixtures/invalid_directory/en.php | 14 ++++++++++++++
.../Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php | 8 ++++++++
.../Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php | 8 ++++++++
6 files changed, 41 insertions(+)
create mode 100644 src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json
create mode 100644 src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php
diff --git a/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php b/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php
index 84b20ab..4a84b64 100644
--- a/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php
+++ b/src/Symfony/Component/Intl/Data/Bundle/Reader/JsonBundleReader.php
@@ -30,6 +30,11 @@ class JsonBundleReader implements BundleReaderInterface
{
$fileName = $path.'/'.$locale.'.json';
+ // prevent directory traversal attacks
+ if (dirname($fileName) !== $path) {
+ throw new ResourceBundleNotFoundException(sprintf('The resource bundle "%s" does not exist.', $fileName));
+ }
+
if (!file_exists($fileName)) {
throw new ResourceBundleNotFoundException(sprintf(
'The resource bundle "%s/%s.json" does not exist.',
diff --git a/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php b/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php
index 57391ce..0b66bb1 100644
--- a/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php
+++ b/src/Symfony/Component/Intl/Data/Bundle/Reader/PhpBundleReader.php
@@ -30,6 +30,11 @@ class PhpBundleReader implements BundleReaderInterface
{
$fileName = $path.'/'.$locale.'.php';
+ // prevent directory traversal attacks
+ if (dirname($fileName) !== $path) {
+ throw new ResourceBundleNotFoundException(sprintf('The resource bundle "%s" does not exist.', $fileName));
+ }
+
if (!file_exists($fileName)) {
throw new ResourceBundleNotFoundException(sprintf(
'The resource bundle "%s/%s.php" does not exist.',
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json
new file mode 100644
index 0000000..16ea32a
--- /dev/null
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.json
@@ -0,0 +1 @@
+{"Foo":"Bar"}
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php
new file mode 100644
index 0000000..f2b06a9
--- /dev/null
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/Fixtures/invalid_directory/en.php
@@ -0,0 +1,14 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+return array(
+ 'Foo' => 'Bar',
+);
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php
index a6183ed..8366372 100644
--- a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/JsonBundleReaderTest.php
@@ -68,4 +68,12 @@ class JsonBundleReaderTest extends \PHPUnit_Framework_TestCase
{
$this->reader->read(__DIR__.'/Fixtures/json', 'en_Invalid');
}
+
+ /**
+ * @expectedException \Symfony\Component\Intl\Exception\ResourceBundleNotFoundException
+ */
+ public function testReaderDoesNotBreakOutOfGivenPath()
+ {
+ $this->reader->read(__DIR__.'/Fixtures/json', '../invalid_directory/en');
+ }
}
diff --git a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php
index 3c58ee7..a026954 100644
--- a/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php
+++ b/src/Symfony/Component/Intl/Tests/Data/Bundle/Reader/PhpBundleReaderTest.php
@@ -60,4 +60,12 @@ class PhpBundleReaderTest extends \PHPUnit_Framework_TestCase
{
$this->reader->read(__DIR__.'/Fixtures/NotAFile', 'en');
}
+
+ /**
+ * @expectedException \Symfony\Component\Intl\Exception\ResourceBundleNotFoundException
+ */
+ public function testReaderDoesNotBreakOutOfGivenPath()
+ {
+ $this->reader->read(__DIR__.'/Fixtures/php', '../invalid_directory/en');
+ }
}
|
