merged branch fabpot/host-check (PR #6209)
This PR was merged into the 2.0 branch.
Commits
-------
0489799
[HttpFoundation] added a check for the host header value
Discussion
----------
[HttpFoundation] added a check for the host header value
alternative for #3865
This commit is contained in:
commit
e277258e91
@ -796,6 +796,8 @@ class Request
|
|||||||
*
|
*
|
||||||
* @return string
|
* @return string
|
||||||
*
|
*
|
||||||
|
* @throws \UnexpectedValueException when the host name is invalid
|
||||||
|
*
|
||||||
* @api
|
* @api
|
||||||
*/
|
*/
|
||||||
public function getHost()
|
public function getHost()
|
||||||
@ -803,19 +805,23 @@ class Request
|
|||||||
if (self::$trustProxy && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
|
if (self::$trustProxy && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
|
||||||
$elements = explode(',', $host);
|
$elements = explode(',', $host);
|
||||||
|
|
||||||
$host = trim($elements[count($elements) - 1]);
|
$host = $elements[count($elements) - 1];
|
||||||
} else {
|
} elseif (!$host = $this->headers->get('HOST')) {
|
||||||
if (!$host = $this->headers->get('HOST')) {
|
if (!$host = $this->server->get('SERVER_NAME')) {
|
||||||
if (!$host = $this->server->get('SERVER_NAME')) {
|
$host = $this->server->get('SERVER_ADDR', '');
|
||||||
$host = $this->server->get('SERVER_ADDR', '');
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Remove port number from host
|
// Trim and remove port number from host
|
||||||
$host = preg_replace('/:\d+$/', '', $host);
|
$host = trim(preg_replace('/:\d+$/', '', $host));
|
||||||
|
|
||||||
return trim($host);
|
// as the host can come from the user (HTTP_HOST and depending on the configuration, SERVER_NAME too can come from the user)
|
||||||
|
// check that it does not contain forbidden characters (see RFC 952 and RFC 2181)
|
||||||
|
if ($host && !preg_match('/^\[?(?:[a-zA-Z0-9-:\]_]+\.?)+$/', $host)) {
|
||||||
|
throw new \UnexpectedValueException('Invalid Host');
|
||||||
|
}
|
||||||
|
|
||||||
|
return $host;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -412,9 +412,6 @@ class RequestTest extends \PHPUnit_Framework_TestCase
|
|||||||
$this->assertEquals('foo=1&foo=2', $request->getQueryString(), '->getQueryString() allows repeated parameters');
|
$this->assertEquals('foo=1&foo=2', $request->getQueryString(), '->getQueryString() allows repeated parameters');
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* @covers Symfony\Component\HttpFoundation\Request::getHost
|
|
||||||
*/
|
|
||||||
public function testGetHost()
|
public function testGetHost()
|
||||||
{
|
{
|
||||||
$request = new Request();
|
$request = new Request();
|
||||||
@ -435,6 +432,17 @@ class RequestTest extends \PHPUnit_Framework_TestCase
|
|||||||
|
|
||||||
$request->initialize(array(), array(), array(), array(), array(), array('SERVER_NAME' => 'www.exemple.com', 'HTTP_HOST' => 'www.host.com'));
|
$request->initialize(array(), array(), array(), array(), array(), array('SERVER_NAME' => 'www.exemple.com', 'HTTP_HOST' => 'www.host.com'));
|
||||||
$this->assertEquals('www.host.com', $request->getHost(), '->getHost() value from Host header has priority over SERVER_NAME ');
|
$this->assertEquals('www.host.com', $request->getHost(), '->getHost() value from Host header has priority over SERVER_NAME ');
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @expectedException RuntimeException
|
||||||
|
*/
|
||||||
|
public function testGetHostWithFakeHttpHostValue()
|
||||||
|
{
|
||||||
|
$request = new Request();
|
||||||
|
$request->initialize(array(), array(), array(), array(), array(), array('HTTP_HOST' => 'www.host.com?query=string'));
|
||||||
|
$request->getHost();
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
Reference in New Issue
Block a user