Skip to content

[Security] Fix for check_path and logout #6040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

[Security] Fix for check_path and logout #6040

wants to merge 2 commits into from

Conversation

omgnull
Copy link

@omgnull omgnull commented Nov 17, 2012

Bug fix: YES
Feature addition: NO
Backwards compatibility break: NO
Symfony2 tests pass: YES
Fixes the following tickets: #5695
License of the code: MIT

@@ -105,7 +105,8 @@ public function checkRequestPath(Request $request, $path)
return false;
}
}

//var_dump($request->getPathInfo());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please remove debug commented line

@omgnull
Copy link
Author

omgnull commented Nov 17, 2012

Done

@Tobion
Copy link
Contributor

Tobion commented Nov 17, 2012

Why this functional test? A simple unit test would be enough to check if it works.

@fabpot
Copy link
Member

fabpot commented Nov 18, 2012

I agree with @Tobion. Functional tests are very slow to run, so whenever we can write unit tests, that's far better.

@empire
Copy link
Contributor

empire commented Nov 18, 2012

I think just adding some unit tests to HttpUtilsTest is really enough.

@empire
Copy link
Contributor

empire commented Nov 18, 2012

The tests doesn't check functionality of rawurldecode function, the test must check something like "foo%20bar%40baz" for route with path like "foo bar@baz".
The rawurldecode is not about unicode, so the given path is not useful.

@empire
Copy link
Contributor

empire commented Nov 18, 2012

Some similar work for line #99 $parameters = $this->urlMatcher->match($request->getPathInfo()); also may be needed

@Tobion
Copy link
Contributor

Tobion commented Nov 18, 2012

Some similar work for line #99 $parameters = $this->urlMatcher->match($request->getPathInfo()); also may be needed

@empire no, the matcher url decodes itself. The rawurldecode is partly about unicode, because multibyte chars get encoded as octets, too. so the test is useful. but the focus here should indeed more be about those standard encodings like %20.

@empire
Copy link
Contributor

empire commented Nov 18, 2012

Thanks @Tobion for your kindly comment.

@omgnull
Copy link
Author

omgnull commented Nov 18, 2012

I don't have a clue what should I do in the unit test, I need any advice for this. In current functional test web client all request and redirects urls like "/%D0%B2%D1%85%D0%BE%D0%B4". May be just add some kind symbol collecton to test.

@empire
Copy link
Contributor

empire commented Nov 18, 2012

@omgnull, I think you can test your work with doing something like following asertion in HttpUtilsTests:

$this->assertTrue($utils->checkRequestPath($this->getRequest('/foo%20bar'), '/foo bar'));
$this->assertFalse($utils->checkRequestPath($this->getRequest('/foo%20bar'), '/foo%20bar'));

@empire
Copy link
Contributor

empire commented Nov 18, 2012

If my previous comment is correct, following assertion is also needed

// Plus must not decoded to space
$this->assertTrue($utils->checkRequestPath($this->getRequest('/foo+bar'), '/foo+bar')); 

// Checking unicode
$this->assertTrue($utils->checkRequestPath($this->getRequest('/%D0%B2%D1%85%D0%BE%D0%B4'), '/вход'));

In hope this comment will be helpful.

@fabpot
Copy link
Member

fabpot commented Dec 6, 2012

@omgnull Does the hints provided by @empire enough to add some unit tests? Do you need some more help?

@omgnull
Copy link
Author

omgnull commented Dec 6, 2012

@fabpot. yes. I have to find some time. This weekend I think.

@fabpot fabpot closed this in d6a402a Dec 11, 2012
fabpot added a commit that referenced this pull request Dec 11, 2012
* 2.1:
  fixed CS
  fixed CS
  [Security] fixed path info encoding (closes #6040, closes #5695)
  [HttpFoundation] added some tests for the previous merge and removed dead code (closes #6037)
  Improved Cache-Control header when no-cache is sent
  removed unneeded comment
  Fix to allow null values in labels array
  fix date in changelog
  removed the Travis icon (as this is not stable enough -- many false positive, closes #6186)
  Revert "merged branch gajdaw/finder_splfileinfo_fpassthu (PR #4751)" (closes #6224)
  Fixed a typo
  Fixed: HeaderBag::parseCacheControl() not parsing quoted zero correctly
  [Form] Fix const inside an anonymous function
  [Config] Loader::import must return imported data
  [DoctrineBridge] Fixed caching in DoctrineType when "choices" or "preferred_choices" is passed
  [Form] Fixed the default value of "format" in DateType to DateType::DEFAULT_FORMAT if "widget" is not "single_text"
  [HttpFoundation] fixed a small regression

Conflicts:
	src/Symfony/Component/HttpFoundation/Tests/Session/Storage/Handler/MongoDbSessionHandlerTest.php
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants