upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

fix(security): Handle idn_to_utf8 returning false

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2023-12-04 10:38:46 +01:00
parent df7bc46eab
commit 33e1c8b236
No known key found for this signature in database
GPG key ID: 74434EFE0D2E2205
3 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/private/Security/RemoteHostValidator.php
View file

@ -52,6 +52,10 @@ final class RemoteHostValidator implements IRemoteHostValidator {
}
$host = idn_to_utf8(strtolower(urldecode($host)));
if ($host === false) {
return false;
}
// Remove brackets from IPv6 addresses
if (str_starts_with($host, '[') && str_ends_with($host, ']')) {
$host = substr($host, 1, -1);

1
tests/lib/Http/Client/ClientTest.php
View file

@ -149,6 +149,7 @@ class ClientTest extends \Test\TestCase {
['https://service.localhost'],
['!@#$', true], // test invalid url
['https://normal.host.com'],
['https://com.one-.nextcloud-one.com'],
];
}

15
tests/lib/Security/RemoteHostValidatorTest.php
View file

@ -60,8 +60,17 @@ class RemoteHostValidatorTest extends TestCase {
);
}
public function testValid(): void {
$host = 'nextcloud.com';
public function dataValid(): array {
return [
['nextcloud.com', true],
['com.one-.nextcloud-one.com', false],
];
}
/**
* @dataProvider dataValid
*/
public function testValid(string $host, bool $expected): void {
$this->hostnameClassifier
->method('isLocalHostname')
->with($host)
@ -73,7 +82,7 @@ class RemoteHostValidatorTest extends TestCase {
$valid = $this->validator->isValid($host);
self::assertTrue($valid);
self::assertSame($expected, $valid);
}
public function testLocalHostname(): void {