Patch 5_3 for URL related Bug #54629

Patch version 2011-05-07 19:26 UTC

• 2011-05-07 19:26 UTC [diff to current]

Developer: dtajchreber@php.net

Index: ext/filter/tests/bug54629.phpt
===================================================================
--- ext/filter/tests/bug54629.phpt	(revision 0)
+++ ext/filter/tests/bug54629.phpt	(revision 0)
@@ -0,0 +1,28 @@
+--TEST--
+Bug #54629 FILTER_VALIDATE_URL rejects IPv6 URLs http://[::1]/
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--FILE--
+<?php
+$a = array(
+	'http://[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]:80/index.html',
+	'http://[1080:0:0:0:8:800:200C:417A]/index.html',
+	'http://[3ffe:2a00:100:7031::1]',
+	'http://[1080::8:800:200C:417A]/foo',
+	'http://[::192.9.5.5]/ipng',
+	'http://[::FFFF:129.144.52.38]:80/index.html',
+	'http://[2010:836B:4179::836B:4179]'
+);
+
+foreach($a as $u) {
+	var_dump(filter_var($u, FILTER_VALIDATE_URL));
+}
+?>
+--EXPECT--	
+string(62) "http://[FEDC:BA98:7654:3210:FEDC:BA98:7654:3210]:80/index.html"
+string(46) "http://[1080:0:0:0:8:800:200C:417A]/index.html"
+string(30) "http://[3ffe:2a00:100:7031::1]"
+string(34) "http://[1080::8:800:200C:417A]/foo"
+string(25) "http://[::192.9.5.5]/ipng"
+string(43) "http://[::FFFF:129.144.52.38]:80/index.html"
+string(34) "http://[2010:836B:4179::836B:4179]"
Index: ext/filter/logical_filters.c
===================================================================
--- ext/filter/logical_filters.c	(revision 310832)
+++ ext/filter/logical_filters.c	(working copy)
@@ -437,65 +437,6 @@
 }
 /* }}} */
 
-void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
-{
-	php_url *url;
-	int old_len = Z_STRLEN_P(value);
-	
-	php_filter_url(value, flags, option_array, charset TSRMLS_CC);
-
-	if (Z_TYPE_P(value) != IS_STRING || old_len != Z_STRLEN_P(value)) {
-		RETURN_VALIDATION_FAILED
-	}
-
-	/* Use parse_url - if it returns false, we return NULL */
-	url = php_url_parse_ex(Z_STRVAL_P(value), Z_STRLEN_P(value));
-
-	if (url == NULL) {
-		RETURN_VALIDATION_FAILED
-	}
-
-	if (url->scheme != NULL && (!strcasecmp(url->scheme, "http") || !strcasecmp(url->scheme, "https"))) {
-		char *e, *s;
-
-		if (url->host == NULL) {
-			goto bad_url;
-		}
-
-		e = url->host + strlen(url->host);
-		s = url->host;
-
-		/* First char of hostname must be alphanumeric */
-		if(!isalnum((int)*(unsigned char *)s)) { 
-			goto bad_url;
-		}
-
-		while (s < e) {
-			if (!isalnum((int)*(unsigned char *)s) && *s != '-' && *s != '.') {
-				goto bad_url;
-			}
-			s++;
-		}
-
-		if (*(e - 1) == '.') {
-			goto bad_url;
-		}
-	}
-
-	if (
-		url->scheme == NULL || 
-		/* some schemas allow the host to be empty */
-		(url->host == NULL && (strcmp(url->scheme, "mailto") && strcmp(url->scheme, "news") && strcmp(url->scheme, "file"))) ||
-		((flags & FILTER_FLAG_PATH_REQUIRED) && url->path == NULL) || ((flags & FILTER_FLAG_QUERY_REQUIRED) && url->query == NULL)
-	) {
-bad_url:
-		php_url_free(url);
-		RETURN_VALIDATION_FAILED
-	}
-	php_url_free(url);
-}
-/* }}} */
-
 void php_filter_validate_email(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 {
 	/*
@@ -776,6 +717,75 @@
 }
 /* }}} */
 
+void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
+{
+	php_url *url;
+	int old_len = Z_STRLEN_P(value);
+	
+	php_filter_url(value, flags, option_array, charset TSRMLS_CC);
+
+	if (Z_TYPE_P(value) != IS_STRING || old_len != Z_STRLEN_P(value)) {
+		RETURN_VALIDATION_FAILED
+	}
+
+	/* Use parse_url - if it returns false, we return NULL */
+	url = php_url_parse_ex(Z_STRVAL_P(value), Z_STRLEN_P(value));
+
+	if (url == NULL) {
+		RETURN_VALIDATION_FAILED
+	}
+
+	if (url->scheme != NULL && (!strcasecmp(url->scheme, "http") || !strcasecmp(url->scheme, "https"))) {
+		char *e, *s;
+
+		if (url->host == NULL) {
+			goto bad_url;
+		}
+
+		e = url->host + strlen(url->host);
+		s = url->host;
+		
+		/* ipv6 check */
+		if(*s == '[' && *(e - 1) == ']') {
+			if(_php_filter_validate_ipv6((s+1), strlen(url->host) - 2 TSRMLS_CC)) {
+				goto good_url;
+			}
+			goto bad_url;
+		}
+
+		/* First char of hostname must be alphanumeric */
+		if(!isalnum((int)*(unsigned char *)s)) { 
+			goto bad_url;
+		}
+
+		while (s < e) {
+			if (!isalnum((int)*(unsigned char *)s) && *s != '-' && *s != '.') {
+				goto bad_url;
+			}
+			s++;
+		}
+
+		if (*(e - 1) == '.') {
+			goto bad_url;
+		}
+	}
+
+	if (
+		url->scheme == NULL || 
+		/* some schemas allow the host to be empty */
+		(url->host == NULL && (strcmp(url->scheme, "mailto") && strcmp(url->scheme, "news") && strcmp(url->scheme, "file"))) ||
+		((flags & FILTER_FLAG_PATH_REQUIRED) && url->path == NULL) || ((flags & FILTER_FLAG_QUERY_REQUIRED) && url->query == NULL)
+	) {
+bad_url:
+		php_url_free(url);
+		RETURN_VALIDATION_FAILED
+	}
+good_url:
+	php_url_free(url);
+}
+/* }}} */
+
+
 /*
  * Local variables:
  * tab-width: 4