From f5e16272277b5bf9ba3064c0634b97eaf20bd93a Mon Sep 17 00:00:00 2001 From: gggeek Date: Sat, 26 Nov 2022 15:27:48 +0000 Subject: [PATCH] allow following redirects: support 307, 308 --- NEWS => NEWS.md | 16 ++++++++++++++++ src/Helper/Http.php | 4 ++-- 2 files changed, 18 insertions(+), 2 deletions(-) rename NEWS => NEWS.md (96%) diff --git a/NEWS b/NEWS.md similarity index 96% rename from NEWS rename to NEWS.md index 71541cb0..4bce20a2 100644 --- a/NEWS +++ b/NEWS.md @@ -1,5 +1,21 @@ XML-RPC for PHP version xxx - unreleased +* security fix: hardened the `Client::send()` method against misuse of the `$method` argument (issue #81). + Abusing its value, it was possible to force the client to _access local files_ or _connect to undesired urls_ instead + of the intended target server's url (the one used in the Client constructor). + + This weakness only affects installations where all of the following conditions apply at the same time: + + - the xmlrpc Client is used, ie. not xmlrpc servers + - untrusted data (eg. data from remote users) is used as value for the `$method` argument of method `Client::send()`, + in conjunction with conditions which trigger usage of curl as http transport (ie. either using the https, http11 or + http2 protocols, or calling `Client::setUseCurl()` beforehand) + - make the resulting Response's object `httpResponse` member, which is intended to be used for debugging purposes only, + available to 3rd parties, eg. by displaying it to the end user or serializing it in some storage (note that the + same data can also be accessed via magic property `Response::raw_data`, and in the Request's `httpResponse` member) + + This is most likely a very uncommon usage scenario, and as such the severity of this issue can be considered low. + * fixed: a php warning on php 8 when parsing responses which do not have a Content-Type header (issue #104) * fixed: added a missing html-escaping call in demo file `introspect.php` diff --git a/src/Helper/Http.php b/src/Helper/Http.php index e54d0828..448df24b 100644 --- a/src/Helper/Http.php +++ b/src/Helper/Http.php @@ -120,9 +120,9 @@ class Http // When using Curl to query servers using Digest Auth, we get back a double set of http headers. // Same when following redirects // We strip out the 1st... - if ($headersProcessed && preg_match('/^HTTP\/[0-9](?:\.[0-9])? (?:401|301|302) /', $data)) { + if ($headersProcessed && preg_match('/^HTTP\/[0-9](?:\.[0-9])? (?:401|30[1278]) /', $data)) { if (preg_match('/(\r?\n){2}HTTP\/[0-9](?:\.[0-9])? 200 /', $data)) { - $data = preg_replace('/^HTTP\/[0-9](?:\.[0-9])? (?:401|301|302) .+?(?:\r?\n){2}(HTTP\/[0-9.]+ 200 )/s', '$1', $data, 1); + $data = preg_replace('/^HTTP\/[0-9](?:\.[0-9])? (?:401|30[1278]) .+?(?:\r?\n){2}(HTTP\/[0-9.]+ 200 )/s', '$1', $data, 1); } } -- 2.47.0