eliseuamaro/gnu-social
1
0
Fork 0
forked from GNUsocial/gnu-social
Code Issues Pull Requests Releases Wiki Activity

[LRDD] Fix unhandled bad data in HostMeta, LinkHTML and WebFinger

Browse Source
This commit is contained in:
Alexei Sorokin
2020-07-22 01:30:04 +03:00
parent 6db56cc949
commit f9e38c1a8d
3 changed files with 81 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
plugins/LRDD/lib/lrddmethod/webfinger.php
View File

@@ -1,13 +1,27 @@
<?php
// This file is part of GNU social - https://www.gnu.org/software/social
//
// GNU social is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// GNU social is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with GNU social. If not, see <http://www.gnu.org/licenses/>.
/**
* Implementation of WebFinger resource discovery (RFC7033)
*
* @category Discovery
* @package GNUsocial
* @author Mikael Nordfeldth <mmn@hethane.se>
* @copyright 2013 Free Software Foundation, Inc.
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
* @link http://status.net/
* @copyright 2013 Free Software Foundation, Inc http://www.fsf.org
* @license https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
*/
class LRDDMethod_WebFinger extends LRDDMethod
{
@@ -17,21 +31,24 @@ class LRDDMethod_WebFinger extends LRDDMethod
*/
public function discover($uri)
{
if (!Discovery::isAcct($uri)) {
throw new Exception('Bad resource URI: '.$uri);
$parts = explode('@', parse_url($uri, PHP_URL_PATH), 2);
if (!Discovery::isAcct($uri) || count($parts) != 2) {
throw new Exception('Bad resource URI: ' . $uri);
}
list($user, $domain) = explode('@', parse_url($uri, PHP_URL_PATH));
[, $domain] = $parts;
if (!filter_var($domain, FILTER_VALIDATE_IP)
&& !filter_var(gethostbyname($domain), FILTER_VALIDATE_IP)) {
&& !filter_var(gethostbyname($domain), FILTER_VALIDATE_IP)) {
throw new Exception('Bad resource host.');
}
$link = new XML_XRD_Element_Link(
Discovery::LRDD_REL,
'https://' . $domain . '/.well-known/webfinger?resource={uri}',
Discovery::JRD_MIMETYPE,
true); //isTemplate
Discovery::LRDD_REL,
'https://' . $domain . '/.well-known/webfinger?resource={uri}',
Discovery::JRD_MIMETYPE,
true // isTemplate
);
return array($link);
return [$link];
}
}