upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-11 01:30:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 79

fix(security): Handle idn_to_utf8 returning false

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2023-12-04 10:38:46 +01:00
parent 71578e452f
commit 75d4798865
No known key found for this signature in database
GPG key ID: 74434EFE0D2E2205
3 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/private/Security/RemoteHostValidator.php
View file

@ -60,6 +60,10 @@ final class RemoteHostValidator implements IRemoteHostValidator {
}
$host = idn_to_utf8(strtolower(urldecode($host)));
if ($host === false) {
return false;
}
// Remove brackets from IPv6 addresses
if (strpos($host, '[') === 0 && substr($host, -1) === ']') {
$host = substr($host, 1, -1);

1
tests/lib/Http/Client/ClientTest.php
View file

@ -166,6 +166,7 @@ class ClientTest extends \Test\TestCase {
['https://service.localhost'],
['!@#$', true], // test invalid url
['https://normal.host.com'],
['https://com.one-.nextcloud-one.com'],
];
}

15
tests/lib/Security/RemoteHostValidatorTest.php
View file

@ -60,8 +60,17 @@ class RemoteHostValidatorTest extends TestCase {
);
}
public function testValid(): void {
$host = 'nextcloud.com';
public function dataValid(): array {
return [
['nextcloud.com', true],
['com.one-.nextcloud-one.com', false],
];
}
/**
* @dataProvider dataValid
*/
public function testValid(string $host, bool $expected): void {
$this->hostnameClassifier
->method('isLocalHostname')
->with($host)
@ -73,7 +82,7 @@ class RemoteHostValidatorTest extends TestCase {
$valid = $this->validator->isValid($host);
self::assertTrue($valid);
self::assertSame($expected, $valid);
}
public function testLocalHostname(): void {