Skip to content

Commit effa287

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-7.4' into PHP-8.0
* PHP-7.4: Alternative fix for bug 77423
2 parents 6462297 + fbf8c75 commit effa287

File tree

8 files changed

+38
-28
lines changed

8 files changed

+38
-28
lines changed

‎ext/filter/logical_filters.c

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -556,6 +556,22 @@ void php_filter_validate_domain(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
556556
}
557557
/* }}} */
558558

559+
static int is_userinfo_valid(zend_string *str)
560+
{
561+
const char *valid = "-._~!$&'()*+,;=:";
562+
const char *p = ZSTR_VAL(str);
563+
while (p - ZSTR_VAL(str) < ZSTR_LEN(str)) {
564+
if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
565+
p++;
566+
} else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
567+
p += 3;
568+
} else {
569+
return 0;
570+
}
571+
}
572+
return 1;
573+
}
574+
559575
void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
560576
{
561577
php_url *url;
@@ -611,6 +627,13 @@ void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
611627
php_url_free(url);
612628
RETURN_VALIDATION_FAILED
613629
}
630+
631+
if (url->user != NULL && !is_userinfo_valid(url->user)) {
632+
php_url_free(url);
633+
RETURN_VALIDATION_FAILED
634+
635+
}
636+
614637
php_url_free(url);
615638
}
616639
/* }}} */

‎ext/standard/tests/url/bug77423.phpt renamed to ‎ext/filter/tests/bug77423.phpt

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,8 @@ $urls = array(
88
);
99
foreach ($urls as $url) {
1010
var_dump(filter_var($url, FILTER_VALIDATE_URL));
11-
var_dump(parse_url($url));
1211
}
1312
?>
1413
--EXPECT--
1514
bool(false)
16-
array(3) {
17-
["scheme"]=>
18-
string(4) "http"
19-
["host"]=>
20-
string(19) "php.net\@aliyun.com"
21-
["path"]=>
22-
string(7) "/aaa.do"
23-
}
2415
bool(false)
25-
array(2) {
26-
["scheme"]=>
27-
string(5) "https"
28-
["host"]=>
29-
string(26) "example.com\uFF03@bing.com"
30-
}

‎ext/standard/tests/strings/url_t.phpt

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -589,13 +589,15 @@ $sample_urls = array (
589589
string(16) "some_page_ref123"
590590
}
591591

592-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
592+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
593593
["scheme"]=>
594594
string(4) "http"
595595
["host"]=>
596-
string(26) "secret@hideout@www.php.net"
596+
string(11) "www.php.net"
597597
["port"]=>
598598
int(80)
599+
["user"]=>
600+
string(14) "secret@hideout"
599601
["path"]=>
600602
string(10) "/index.php"
601603
["query"]=>

‎ext/standard/tests/url/parse_url_basic_001.phpt

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -514,13 +514,15 @@ echo "Done";
514514
string(16) "some_page_ref123"
515515
}
516516

517-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
517+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
518518
["scheme"]=>
519519
string(4) "http"
520520
["host"]=>
521-
string(26) "secret@hideout@www.php.net"
521+
string(11) "www.php.net"
522522
["port"]=>
523523
int(80)
524+
["user"]=>
525+
string(14) "secret@hideout"
524526
["path"]=>
525527
string(10) "/index.php"
526528
["query"]=>

‎ext/standard/tests/url/parse_url_basic_003.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ echo "Done";
6262
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
6363
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
6464
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
65-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(26) "secret@hideout@www.php.net"
65+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
6666
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
6767
--> nntp://news.php.net : string(12) "news.php.net"
6868
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : string(11) "ftp.gnu.org"

‎ext/standard/tests/url/parse_url_basic_005.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ echo "Done";
6262
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
6363
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(0) ""
6464
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
65-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : NULL
65+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(14) "secret@hideout"
6666
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
6767
--> nntp://news.php.net : NULL
6868
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : NULL

‎ext/standard/tests/url/parse_url_unterminated.phpt

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -522,13 +522,15 @@ echo "Done";
522522
string(16) "some_page_ref123"
523523
}
524524

525-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
525+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
526526
["scheme"]=>
527527
string(4) "http"
528528
["host"]=>
529-
string(26) "secret@hideout@www.php.net"
529+
string(11) "www.php.net"
530530
["port"]=>
531531
int(80)
532+
["user"]=>
533+
string(14) "secret@hideout"
532534
["path"]=>
533535
string(10) "/index.php"
534536
["query"]=>

‎ext/standard/url.c

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -249,17 +249,13 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, zend_bool *has
249249
ret->pass = zend_string_init(pp, (p-pp), 0);
250250
php_replace_controlchars_ex(ZSTR_VAL(ret->pass), ZSTR_LEN(ret->pass));
251251
} else {
252-
if (!is_userinfo_valid(s, p-s)) {
253-
goto check_port;
254-
}
255-
ret->user = zend_string_init(s, (p-s), 0);
252+
ret->user = zend_string_init(s, (p-s), 0);
256253
php_replace_controlchars_ex(ZSTR_VAL(ret->user), ZSTR_LEN(ret->user));
257254
}
258255

259256
s = p + 1;
260257
}
261258

262-
check_port:
263259
/* check for port */
264260
if (s < ue && *s == '[' && *(e-1) == ']') {
265261
/* Short circuit portscan,

0 commit comments

Comments
 (0)