|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2016-09-28 08:01 UTC] mala at ma dot la
Description: ------------ url like these - http://example.com:80#@google.com/ - http://example.com:80?@google.com/ parse_url return wrong host. https://tools.ietf.org/html/rfc3986#section-3.2 The authority component is preceded by a double slash ("//") and is terminated by the next slash ("/"), question mark ("?"), or number sign ("#") character, or by the end of the URI. This problem has been fixed in 7.1. https://github.com/php/php-src/pull/1607 But, this issue should be recognized as security issue. example: - bypass authentication protocol (verify hostname of callback url by parse_url) - open redirector (verify hostname by parse_url) - server-side request forgery (verify hostname by parse_url and get_content) Test script: --------------- php > echo parse_url("http://example.com:80#@google.com/")["host"]; google.com php > echo parse_url("http://example.com:80?@google.com/")["host"]; google.com php > echo file_get_contents("http://example.com:80#@google.com"); ... contents of example.com ... Expected result: ---------------- parse_url("http://example.com:80#@google.com/")["host"]; example.com or parse error. PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Sat Nov 23 21:01:28 2024 UTC |
Hi, I wrote ``` Expected result: ---------------- parse_url("http://example.com:80#@google.com/")["host"]; example.com or parse error ``` but, recognized # as end of authority component and same as http://example.com:80/#@google.com/ is more correct. The authority component is preceded by a double slash ("//") and is terminated by the next slash ("/"), question mark ("?"), or number sign ("#") character, or by the end of the URI. in PHP 7.1.0RC3, can't parse these url. php > $result = parse_url("http://example.com:80#@google.com/"); echo $result == null; 1 please review again.1. Reproducing script php > var_dump(parse_url("http://example.com:80#@google.com/")); 2. Expected output array(4) { ["scheme"]=> string(4) "http" ["host"]=> string(11) "example.com" ["port"]=> int(80) ["fragment"]=> string(12) "@google.com/" } 3. Actual output in PHP 7.1 bool(false) in PHP 5.5 php > var_dump(parse_url("http://example.com:80#@google.com/")); array(5) { ["scheme"]=> string(4) "http" ["host"]=> string(10) "google.com" ["user"]=> string(11) "example.com" ["pass"]=> string(3) "80#" ["path"]=> string(1) "/" }