upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

Merge pull request #42085 from nextcloud/backport/41999/stable27

Browse source 
[stable27] fix(security): Handle idn_to_utf8 returning false
This commit is contained in:
Arthur Schiwon 2023-12-07 10:03:13 +01:00 committed by GitHub
commit d3127983bf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/private/Security/RemoteHostValidator.php
View file

@ -60,6 +60,10 @@ final class RemoteHostValidator implements IRemoteHostValidator {
}
$host = idn_to_utf8(strtolower(urldecode($host)));
if ($host === false) {
return false;
}
// Remove brackets from IPv6 addresses
if (strpos($host, '[') === 0 && substr($host, -1) === ']') {
$host = substr($host, 1, -1);

1
tests/lib/Http/Client/ClientTest.php
View file

@ -148,6 +148,7 @@ class ClientTest extends \Test\TestCase {
['https://service.localhost'],
['!@#$', true], // test invalid url
['https://normal.host.com'],
['https://com.one-.nextcloud-one.com'],
];
}

15
tests/lib/Security/RemoteHostValidatorTest.php
View file

@ -60,8 +60,17 @@ class RemoteHostValidatorTest extends TestCase {
);
}
public function testValid(): void {
$host = 'nextcloud.com';
public function dataValid(): array {
return [
['nextcloud.com', true],
['com.one-.nextcloud-one.com', false],
];
}
/**
* @dataProvider dataValid
*/
public function testValid(string $host, bool $expected): void {
$this->hostnameClassifier
->method('isLocalHostname')
->with($host)
@ -73,7 +82,7 @@ class RemoteHostValidatorTest extends TestCase {
$valid = $this->validator->isValid($host);
self::assertTrue($valid);
self::assertSame($expected, $valid);
}
public function testLocalHostname(): void {