diff options
author | Daniel Kesselberg <mail@danielkesselberg.de> | 2020-01-16 13:26:29 +0300 |
---|---|---|
committer | Daniel Kesselberg <mail@danielkesselberg.de> | 2020-01-16 13:26:29 +0300 |
commit | 8331d8296b1972224cf6e1e391bba1c9380799a5 (patch) | |
tree | 0dfdb80975279db842b42480e9bf3039ddd03935 | |
parent | 5de3ea04170afd25a31f249a922feb3f9b189242 (diff) |
Make getServerHost more robust to faulty user input
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
-rw-r--r-- | lib/private/AppFramework/Http/Request.php | 14 | ||||
-rw-r--r-- | tests/lib/AppFramework/Http/RequestTest.php | 46 |
2 files changed, 53 insertions, 7 deletions
diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php index 3563ce3a200..6554250902d 100644 --- a/lib/private/AppFramework/Http/Request.php +++ b/lib/private/AppFramework/Http/Request.php @@ -904,14 +904,14 @@ class Request implements \ArrayAccess, \Countable, IRequest { $trustedDomainHelper = new TrustedDomainHelper($this->config); if ($trustedDomainHelper->isTrustedDomain($host)) { return $host; - } else { - $trustedList = $this->config->getSystemValue('trusted_domains', []); - if(!empty($trustedList)) { - return $trustedList[0]; - } else { - return ''; - } } + + $trustedList = (array)$this->config->getSystemValue('trusted_domains', []); + if (count($trustedList) > 0) { + return reset($trustedList); + } + + return ''; } /** diff --git a/tests/lib/AppFramework/Http/RequestTest.php b/tests/lib/AppFramework/Http/RequestTest.php index 56982aaf511..be019050e1b 100644 --- a/tests/lib/AppFramework/Http/RequestTest.php +++ b/tests/lib/AppFramework/Http/RequestTest.php @@ -1222,6 +1222,52 @@ class RequestTest extends \Test\TestCase { $this->assertSame('', $request->getServerHost()); } + /** + * @return array + */ + public function dataGetServerHostTrustedDomain() { + return [ + 'is array' => ['my.trusted.host', ['my.trusted.host']], + 'is array but undefined index 0' => ['my.trusted.host', [2 => 'my.trusted.host']], + 'is string' => ['my.trusted.host', 'my.trusted.host'], + 'is null' => ['', null], + ]; + } + + /** + * @dataProvider dataGetServerHostTrustedDomain + * @param $expected + * @param $trustedDomain + */ + public function testGetServerHostTrustedDomain($expected, $trustedDomain) { + $this->config + ->method('getSystemValue') + ->willReturnCallback(function ($key, $default) use ($trustedDomain) { + if ($key === 'trusted_proxies') { + return ['1.2.3.4']; + } + if ($key === 'trusted_domains') { + return $trustedDomain; + } + return $default; + }); + + $request = new Request( + [ + 'server' => [ + 'HTTP_X_FORWARDED_HOST' => 'my.untrusted.host', + 'REMOTE_ADDR' => '1.2.3.4', + ], + ], + $this->secureRandom, + $this->config, + $this->csrfTokenManager, + $this->stream + ); + + $this->assertSame($expected, $request->getServerHost()); + } + public function testGetOverwriteHostDefaultNull() { $this->config ->expects($this->once()) |