allow following redirects: support 307, 308

diff --git a/NEWS b/NEWS.md
similarity index 96%
rename from NEWS
rename to NEWS.md
index 71541cb..4bce20a 100644 (file)
--- a/NEWS
+++ b/NEWS.md
@@ -1,5 +1,21 @@
 XML-RPC for PHP version xxx - unreleased
 
+* security fix: hardened the `Client::send()` method against misuse of the `$method` argument (issue #81).
+  Abusing its value, it was possible to force the client to _access local files_ or _connect to undesired urls_ instead
+  of the intended target server's url (the one used in the Client constructor).
+
+  This weakness only affects installations where all of the following conditions apply at the same time:
+
+  - the xmlrpc Client is used, ie. not xmlrpc servers
+  - untrusted data (eg. data from remote users) is used as value for the `$method` argument of method `Client::send()`,
+    in conjunction with conditions which trigger usage of curl as http transport (ie. either using the https, http11 or
+    http2 protocols, or calling `Client::setUseCurl()` beforehand)
+  - make the resulting Response's object `httpResponse` member, which is intended to be used for debugging purposes only,
+    available to 3rd parties, eg. by displaying it to the end user or serializing it in some storage (note that the
+    same data can also be accessed via magic property `Response::raw_data`, and in the Request's `httpResponse` member)
+
+  This is most likely a very uncommon usage scenario, and as such the severity of this issue can be considered low.
+
 * fixed: a php warning on php 8 when parsing responses which do not have a Content-Type header (issue #104)
 
 * fixed: added a missing html-escaping call in demo file `introspect.php`

diff --git a/src/Helper/Http.php b/src/Helper/Http.php
index e54d082..448df24 100644 (file)
--- a/src/Helper/Http.php
+++ b/src/Helper/Http.php
@@ -120,9 +120,9 @@ class Http
         // When using Curl to query servers using Digest Auth, we get back a double set of http headers.
         // Same when following redirects
         // We strip out the 1st...
-        if ($headersProcessed && preg_match('/^HTTP\/[0-9](?:\.[0-9])? (?:401|301|302) /', $data)) {
+        if ($headersProcessed && preg_match('/^HTTP\/[0-9](?:\.[0-9])? (?:401|30[1278]) /', $data)) {
             if (preg_match('/(\r?\n){2}HTTP\/[0-9](?:\.[0-9])? 200 /', $data)) {
-                $data = preg_replace('/^HTTP\/[0-9](?:\.[0-9])? (?:401|301|302) .+?(?:\r?\n){2}(HTTP\/[0-9.]+ 200 )/s', '$1', $data, 1);
+                $data = preg_replace('/^HTTP\/[0-9](?:\.[0-9])? (?:401|30[1278]) .+?(?:\r?\n){2}(HTTP\/[0-9.]+ 200 )/s', '$1', $data, 1);
             }
         }