Skip to content
This repository has been archived by the owner on Jan 8, 2020. It is now read-only.

fixed #7018 : Hostname validator used disallowed unicode code points #7019

Closed
wants to merge 1 commit into from
Closed

fixed #7018 : Hostname validator used disallowed unicode code points #7019

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 17 additions & 21 deletions library/Zend/Validator/Hostname.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1195,15 +1195,14 @@ public function isValid($value)

$this->setValue($value);
// Check input against IP address schema
if (preg_match('/^[0-9a-f:.]*$/i', $value) && $this->getIpValidator()
->setTranslator($this->getTranslator())
->isValid($value)) {
if (preg_match('/^[0-9a-f:.]*$/i', $value)
&& $this->getIpValidator()->setTranslator($this->getTranslator())->isValid($value)
) {
if (!($this->getAllow() & self::ALLOW_IP)) {
$this->error(self::IP_ADDRESS_NOT_ALLOWED);
return false;
} else {
return true;
}
return true;
}

// Local hostnames are allowed to be partial (ending '.')
Expand All @@ -1221,26 +1220,27 @@ public function isValid($value)
$domainParts = explode('.', $value);

// Prevent partial IP V4 addresses (ending '.')
if ((count($domainParts) == 4) && preg_match('/^[0-9.a-e:.]*$/i', $value) && $this->getIpValidator()
->setTranslator($this->getTranslator())
->isValid($value)) {
if (count($domainParts) == 4 && preg_match('/^[0-9.a-e:.]*$/i', $value)
&& $this->getIpValidator()->setTranslator($this->getTranslator())->isValid($value)
) {
$this->error(self::INVALID_LOCAL_NAME);
}

$utf8StrWrapper = StringUtils::getWrapper('UTF-8');

// Check input against DNS hostname schema
if ((count($domainParts) > 1)
&& ($utf8StrWrapper->strlen($value) >= 4)
&& ($utf8StrWrapper->strlen($value) <= 254)
if (count($domainParts) > 1
&& $utf8StrWrapper->strlen($value) >= 4
&& $utf8StrWrapper->strlen($value) <= 254
) {
$status = false;

do {
// First check TLD
$matches = array();
if (preg_match('/([^.]{2,63})$/iu', end($domainParts), $matches)
|| (array_key_exists(end($domainParts), $this->validIdns))) {
|| (array_key_exists(end($domainParts), $this->validIdns))
) {
reset($domainParts);

// Hostname characters are: *(label dot)(label dot label); max 254 chars
Expand Down Expand Up @@ -1289,8 +1289,8 @@ public function isValid($value)
}

// Check dash (-) does not start, end or appear in 3rd and 4th positions
if (($utf8StrWrapper->strpos($domainPart, '-') === 0)
|| (($utf8StrWrapper->strlen($domainPart) > 2) && ($utf8StrWrapper->strpos($domainPart, '-', 2) == 2) && ($utf8StrWrapper->strpos($domainPart, '-', 3) == 3))
if ($utf8StrWrapper->strpos($domainPart, '-') === 0
|| ($utf8StrWrapper->strlen($domainPart) > 2 && $utf8StrWrapper->strpos($domainPart, '-', 2) == 2 && $utf8StrWrapper->strpos($domainPart, '-', 3) == 3)
|| ($utf8StrWrapper->strpos($domainPart, '-') === ($utf8StrWrapper->strlen($domainPart) - 1))
) {
$this->error(self::INVALID_DASH);
Expand All @@ -1301,13 +1301,12 @@ public function isValid($value)
// Check each domain part
$checked = false;
foreach ($regexChars as $regexKey => $regexChar) {
ErrorHandler::start();
$status = preg_match($regexChar, $domainPart);
ErrorHandler::stop();
if ($status > 0) {
$length = 63;
if (array_key_exists($this->tld, $this->idnLength)
&& (array_key_exists($regexKey, $this->idnLength[$this->tld]))) {
&& array_key_exists($regexKey, $this->idnLength[$this->tld])
) {
$length = $this->idnLength[$this->tld];
}

Expand Down Expand Up @@ -1352,16 +1351,13 @@ public function isValid($value)
if ($this->getAllow() & self::ALLOW_URI) {
if (preg_match("/^([a-zA-Z0-9-._~!$&\'()*+,;=]|%[[:xdigit:]]{2}){1,254}$/i", $value)) {
return true;
} else {
$this->error(self::INVALID_URI);
}
$this->error(self::INVALID_URI);
}

// Check input against local network name schema; last chance to pass validation
ErrorHandler::start();
$regexLocal = '/^(([a-zA-Z0-9\x2d]{1,63}\x2e)*[a-zA-Z0-9\x2d]{1,63}[\x2e]{0,1}){1,254}$/';
$status = preg_match($regexLocal, $value);
ErrorHandler::stop();

// If the input passes as a local network name, and local network names are allowed, then the
// hostname passes validation
Expand Down
2 changes: 0 additions & 2 deletions library/Zend/Validator/Hostname/Com.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,8 +169,6 @@
68 => '/^[\x{A000}-\x{A48F}]{1,63}$/iu',
69 => '/^[\x{A490}-\x{A4CF}]{1,63}$/iu',
70 => '/^[\x{AC00}-\x{D7AF}]{1,63}$/iu',
71 => '/^[\x{D800}-\x{DB7F}]{1,63}$/iu',
72 => '/^[\x{DC00}-\x{DFFF}]{1,63}$/iu',
73 => '/^[\x{F900}-\x{FAFF}]{1,63}$/iu',
74 => '/^[\x{FB00}-\x{FB4F}]{1,63}$/iu',
75 => '/^[\x{FB50}-\x{FDFF}]{1,63}$/iu',
Expand Down