Skip to content

Commit fbf8c75

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3: Alternative fix for bug 77423
2 parents 6a0b889 + 4a89e72 commit fbf8c75

File tree

8 files changed

+38
-28
lines changed

8 files changed

+38
-28
lines changed

‎ext/filter/logical_filters.c

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -555,6 +555,22 @@ void php_filter_validate_domain(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
555555
}
556556
/* }}} */
557557

558+
static int is_userinfo_valid(zend_string *str)
559+
{
560+
const char *valid = "-._~!$&'()*+,;=:";
561+
const char *p = ZSTR_VAL(str);
562+
while (p - ZSTR_VAL(str) < ZSTR_LEN(str)) {
563+
if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
564+
p++;
565+
} else if (*p == '%' && p - ZSTR_VAL(str) <= ZSTR_LEN(str) - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
566+
p += 3;
567+
} else {
568+
return 0;
569+
}
570+
}
571+
return 1;
572+
}
573+
558574
void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
559575
{
560576
php_url *url;
@@ -615,6 +631,13 @@ void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
615631
php_url_free(url);
616632
RETURN_VALIDATION_FAILED
617633
}
634+
635+
if (url->user != NULL && !is_userinfo_valid(url->user)) {
636+
php_url_free(url);
637+
RETURN_VALIDATION_FAILED
638+
639+
}
640+
618641
php_url_free(url);
619642
}
620643
/* }}} */

‎ext/standard/tests/url/bug77423.phpt renamed to ‎ext/filter/tests/bug77423.phpt

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,8 @@ $urls = array(
88
);
99
foreach ($urls as $url) {
1010
var_dump(filter_var($url, FILTER_VALIDATE_URL));
11-
var_dump(parse_url($url));
1211
}
1312
?>
1413
--EXPECT--
1514
bool(false)
16-
array(3) {
17-
["scheme"]=>
18-
string(4) "http"
19-
["host"]=>
20-
string(19) "php.net\@aliyun.com"
21-
["path"]=>
22-
string(7) "/aaa.do"
23-
}
2415
bool(false)
25-
array(2) {
26-
["scheme"]=>
27-
string(5) "https"
28-
["host"]=>
29-
string(26) "example.com\uFF03@bing.com"
30-
}

‎ext/standard/tests/strings/url_t.phpt

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -575,13 +575,15 @@ $sample_urls = array (
575575
string(16) "some_page_ref123"
576576
}
577577

578-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
578+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
579579
["scheme"]=>
580580
string(4) "http"
581581
["host"]=>
582-
string(26) "secret@hideout@www.php.net"
582+
string(11) "www.php.net"
583583
["port"]=>
584584
int(80)
585+
["user"]=>
586+
string(14) "secret@hideout"
585587
["path"]=>
586588
string(10) "/index.php"
587589
["query"]=>

‎ext/standard/tests/url/parse_url_basic_001.phpt

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -506,13 +506,15 @@ echo "Done";
506506
string(16) "some_page_ref123"
507507
}
508508

509-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
509+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
510510
["scheme"]=>
511511
string(4) "http"
512512
["host"]=>
513-
string(26) "secret@hideout@www.php.net"
513+
string(11) "www.php.net"
514514
["port"]=>
515515
int(80)
516+
["user"]=>
517+
string(14) "secret@hideout"
516518
["path"]=>
517519
string(10) "/index.php"
518520
["query"]=>

‎ext/standard/tests/url/parse_url_basic_003.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ echo "Done";
6868
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
6969
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
7070
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
71-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(26) "secret@hideout@www.php.net"
71+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
7272
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
7373
--> nntp://news.php.net : string(12) "news.php.net"
7474
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : string(11) "ftp.gnu.org"

‎ext/standard/tests/url/parse_url_basic_005.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ echo "Done";
6868
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
6969
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(0) ""
7070
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
71-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : NULL
71+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(14) "secret@hideout"
7272
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
7373
--> nntp://news.php.net : NULL
7474
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : NULL

‎ext/standard/tests/url/parse_url_unterminated.phpt

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -508,13 +508,15 @@ echo "Done";
508508
string(16) "some_page_ref123"
509509
}
510510

511-
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
511+
--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
512512
["scheme"]=>
513513
string(4) "http"
514514
["host"]=>
515-
string(26) "secret@hideout@www.php.net"
515+
string(11) "www.php.net"
516516
["port"]=>
517517
int(80)
518+
["user"]=>
519+
string(14) "secret@hideout"
518520
["path"]=>
519521
string(10) "/index.php"
520522
["query"]=>

‎ext/standard/url.c

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -256,17 +256,13 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, zend_bool *has
256256
ret->pass = zend_string_init(pp, (p-pp), 0);
257257
php_replace_controlchars_ex(ZSTR_VAL(ret->pass), ZSTR_LEN(ret->pass));
258258
} else {
259-
if (!is_userinfo_valid(s, p-s)) {
260-
goto check_port;
261-
}
262-
ret->user = zend_string_init(s, (p-s), 0);
259+
ret->user = zend_string_init(s, (p-s), 0);
263260
php_replace_controlchars_ex(ZSTR_VAL(ret->user), ZSTR_LEN(ret->user));
264261
}
265262

266263
s = p + 1;
267264
}
268265

269-
check_port:
270266
/* check for port */
271267
if (s < ue && *s == '[' && *(e-1) == ']') {
272268
/* Short circuit portscan,

0 commit comments

Comments
 (0)