!37 Fix CVE-2020-7071
From: @panxh_purple Reviewed-by: @small_leek Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot
Gitee
commit
91a59a20d4
197
backport-CVE-2020-7071-Fix-bug-77423.patch
Normal file
197
backport-CVE-2020-7071-Fix-bug-77423.patch
Normal file
@ -0,0 +1,197 @@
|
|||||||
|
From 5174de7cd33c3d4fa591c9c93859ff9989b07e8c Mon Sep 17 00:00:00 2001
|
||||||
|
From: "Christoph M. Becker" <cmbecker69@gmx.de>
|
||||||
|
Date: Wed, 13 May 2020 09:36:52 +0200
|
||||||
|
Subject: [PATCH] Fix #77423: parse_url() will deliver a wrong host to user
|
||||||
|
|
||||||
|
To avoid that `parse_url()` returns an erroneous host, which would be
|
||||||
|
valid for `FILTER_VALIDATE_URL`, we make sure that only userinfo which
|
||||||
|
is valid according to RFC 3986 is treated as such.
|
||||||
|
|
||||||
|
For consistency with the existing url parsing code, we use ctype
|
||||||
|
functions, although that is not necessarily correct.
|
||||||
|
---
|
||||||
|
ext/standard/tests/strings/url_t.phpt | 6 ++--
|
||||||
|
ext/standard/tests/url/bug77423.phpt | 30 +++++++++++++++++++
|
||||||
|
.../tests/url/parse_url_basic_001.phpt | 6 ++--
|
||||||
|
.../tests/url/parse_url_basic_003.phpt | 2 +-
|
||||||
|
.../tests/url/parse_url_basic_005.phpt | 2 +-
|
||||||
|
.../tests/url/parse_url_unterminated.phpt | 6 ++--
|
||||||
|
ext/standard/url.c | 24 +++++++++++++--
|
||||||
|
7 files changed, 60 insertions(+), 16 deletions(-)
|
||||||
|
create mode 100644 ext/standard/tests/url/bug77423.phpt
|
||||||
|
|
||||||
|
diff --git a/ext/standard/tests/strings/url_t.phpt b/ext/standard/tests/strings/url_t.phpt
|
||||||
|
index caa93cb9cf01..dc13018b14a0 100644
|
||||||
|
--- a/ext/standard/tests/strings/url_t.phpt
|
||||||
|
+++ b/ext/standard/tests/strings/url_t.phpt
|
||||||
|
@@ -589,15 +589,13 @@ $sample_urls = array (
|
||||||
|
string(16) "some_page_ref123"
|
||||||
|
}
|
||||||
|
|
||||||
|
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
|
||||||
|
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
|
||||||
|
["scheme"]=>
|
||||||
|
string(4) "http"
|
||||||
|
["host"]=>
|
||||||
|
- string(11) "www.php.net"
|
||||||
|
+ string(26) "secret@hideout@www.php.net"
|
||||||
|
["port"]=>
|
||||||
|
int(80)
|
||||||
|
- ["user"]=>
|
||||||
|
- string(14) "secret@hideout"
|
||||||
|
["path"]=>
|
||||||
|
string(10) "/index.php"
|
||||||
|
["query"]=>
|
||||||
|
diff --git a/ext/standard/tests/url/bug77423.phpt b/ext/standard/tests/url/bug77423.phpt
|
||||||
|
new file mode 100644
|
||||||
|
index 000000000000..be03fe95e24e
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/ext/standard/tests/url/bug77423.phpt
|
||||||
|
@@ -0,0 +1,30 @@
|
||||||
|
+--TEST--
|
||||||
|
+Bug #77423 (parse_url() will deliver a wrong host to user)
|
||||||
|
+--FILE--
|
||||||
|
+<?php
|
||||||
|
+$urls = array(
|
||||||
|
+ "http://php.net\@aliyun.com/aaa.do",
|
||||||
|
+ "https://example.com\uFF03@bing.com",
|
||||||
|
+);
|
||||||
|
+foreach ($urls as $url) {
|
||||||
|
+ var_dump(filter_var($url, FILTER_VALIDATE_URL));
|
||||||
|
+ var_dump(parse_url($url));
|
||||||
|
+}
|
||||||
|
+?>
|
||||||
|
+--EXPECT--
|
||||||
|
+bool(false)
|
||||||
|
+array(3) {
|
||||||
|
+ ["scheme"]=>
|
||||||
|
+ string(4) "http"
|
||||||
|
+ ["host"]=>
|
||||||
|
+ string(19) "php.net\@aliyun.com"
|
||||||
|
+ ["path"]=>
|
||||||
|
+ string(7) "/aaa.do"
|
||||||
|
+}
|
||||||
|
+bool(false)
|
||||||
|
+array(2) {
|
||||||
|
+ ["scheme"]=>
|
||||||
|
+ string(5) "https"
|
||||||
|
+ ["host"]=>
|
||||||
|
+ string(26) "example.com\uFF03@bing.com"
|
||||||
|
+}
|
||||||
|
diff --git a/ext/standard/tests/url/parse_url_basic_001.phpt b/ext/standard/tests/url/parse_url_basic_001.phpt
|
||||||
|
index f3abd703b263..89b1b7b3d683 100644
|
||||||
|
--- a/ext/standard/tests/url/parse_url_basic_001.phpt
|
||||||
|
+++ b/ext/standard/tests/url/parse_url_basic_001.phpt
|
||||||
|
@@ -514,15 +514,13 @@ echo "Done";
|
||||||
|
string(16) "some_page_ref123"
|
||||||
|
}
|
||||||
|
|
||||||
|
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
|
||||||
|
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
|
||||||
|
["scheme"]=>
|
||||||
|
string(4) "http"
|
||||||
|
["host"]=>
|
||||||
|
- string(11) "www.php.net"
|
||||||
|
+ string(26) "secret@hideout@www.php.net"
|
||||||
|
["port"]=>
|
||||||
|
int(80)
|
||||||
|
- ["user"]=>
|
||||||
|
- string(14) "secret@hideout"
|
||||||
|
["path"]=>
|
||||||
|
string(10) "/index.php"
|
||||||
|
["query"]=>
|
||||||
|
diff --git a/ext/standard/tests/url/parse_url_basic_003.phpt b/ext/standard/tests/url/parse_url_basic_003.phpt
|
||||||
|
index 1eb64d6a1b1c..da35b927821a 100644
|
||||||
|
--- a/ext/standard/tests/url/parse_url_basic_003.phpt
|
||||||
|
+++ b/ext/standard/tests/url/parse_url_basic_003.phpt
|
||||||
|
@@ -62,7 +62,7 @@ echo "Done";
|
||||||
|
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||||
|
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||||
|
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||||
|
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||||
|
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(26) "secret@hideout@www.php.net"
|
||||||
|
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||||
|
--> nntp://news.php.net : string(12) "news.php.net"
|
||||||
|
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : string(11) "ftp.gnu.org"
|
||||||
|
diff --git a/ext/standard/tests/url/parse_url_basic_005.phpt b/ext/standard/tests/url/parse_url_basic_005.phpt
|
||||||
|
index dfbe7e7971e4..731a4adb3149 100644
|
||||||
|
--- a/ext/standard/tests/url/parse_url_basic_005.phpt
|
||||||
|
+++ b/ext/standard/tests/url/parse_url_basic_005.phpt
|
||||||
|
@@ -62,7 +62,7 @@ echo "Done";
|
||||||
|
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
|
||||||
|
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(0) ""
|
||||||
|
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
|
||||||
|
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(14) "secret@hideout"
|
||||||
|
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : NULL
|
||||||
|
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
|
||||||
|
--> nntp://news.php.net : NULL
|
||||||
|
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : NULL
|
||||||
|
diff --git a/ext/standard/tests/url/parse_url_unterminated.phpt b/ext/standard/tests/url/parse_url_unterminated.phpt
|
||||||
|
index 7c9150a513d9..f859fc7d407f 100644
|
||||||
|
--- a/ext/standard/tests/url/parse_url_unterminated.phpt
|
||||||
|
+++ b/ext/standard/tests/url/parse_url_unterminated.phpt
|
||||||
|
@@ -522,15 +522,13 @@ echo "Done";
|
||||||
|
string(16) "some_page_ref123"
|
||||||
|
}
|
||||||
|
|
||||||
|
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
|
||||||
|
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
|
||||||
|
["scheme"]=>
|
||||||
|
string(4) "http"
|
||||||
|
["host"]=>
|
||||||
|
- string(11) "www.php.net"
|
||||||
|
+ string(26) "secret@hideout@www.php.net"
|
||||||
|
["port"]=>
|
||||||
|
int(80)
|
||||||
|
- ["user"]=>
|
||||||
|
- string(14) "secret@hideout"
|
||||||
|
["path"]=>
|
||||||
|
string(10) "/index.php"
|
||||||
|
["query"]=>
|
||||||
|
diff --git a/ext/standard/url.c b/ext/standard/url.c
|
||||||
|
index a33091a86b75..113e0100243a 100644
|
||||||
|
--- a/ext/standard/url.c
|
||||||
|
+++ b/ext/standard/url.c
|
||||||
|
@@ -92,6 +92,22 @@ static const char *binary_strcspn(const char *s, const char *e, const char *char
|
||||||
|
return e;
|
||||||
|
}
|
||||||
|
|
||||||
|
+static int is_userinfo_valid(const char *str, size_t len)
|
||||||
|
+{
|
||||||
|
+ const char *valid = "-._~!$&'()*+,;=:";
|
||||||
|
+ const char *p = str;
|
||||||
|
+ while (p - str < len) {
|
||||||
|
+ if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
|
||||||
|
+ p++;
|
||||||
|
+ } else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
|
||||||
|
+ p += 3;
|
||||||
|
+ } else {
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ return 1;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/* {{{ php_url_parse */
|
||||||
|
PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
|
||||||
|
{
|
||||||
|
@@ -233,13 +249,17 @@ PHPAPI php_url *php_url_parse_ex2(char const *str, size_t length, zend_bool *has
|
||||||
|
ret->pass = zend_string_init(pp, (p-pp), 0);
|
||||||
|
php_replace_controlchars_ex(ZSTR_VAL(ret->pass), ZSTR_LEN(ret->pass));
|
||||||
|
} else {
|
||||||
|
- ret->user = zend_string_init(s, (p-s), 0);
|
||||||
|
- php_replace_controlchars_ex(ZSTR_VAL(ret->user), ZSTR_LEN(ret->user));
|
||||||
|
+ if (!is_userinfo_valid(s, p-s)) {
|
||||||
|
+ goto check_port;
|
||||||
|
+ }
|
||||||
|
+ ret->user = zend_string_init(s, (p-s), 0);
|
||||||
|
+ php_replace_controlchars_ex(ZSTR_VAL(ret->user), ZSTR_LEN(ret->user));
|
||||||
|
}
|
||||||
|
|
||||||
|
s = p + 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
+check_port:
|
||||||
|
/* check for port */
|
||||||
|
if (s < ue && *s == '[' && *(e-1) == ']') {
|
||||||
|
/* Short circuit portscan,
|
||||||
26
php.spec
26
php.spec
@ -27,9 +27,9 @@
|
|||||||
|
|
||||||
Name: php
|
Name: php
|
||||||
Version: %{upver}%{?rcver:~%{rcver}}
|
Version: %{upver}%{?rcver:~%{rcver}}
|
||||||
Release: 1
|
Release: 2
|
||||||
Summary: PHP scripting language for creating dynamic web sites
|
Summary: PHP scripting language for creating dynamic web sites
|
||||||
License: PHP and Zend and BSD and MIT and ASL 1.0 and NCSA
|
License: PHP and Zend-2.0 and BSD and MIT and ASL 1.0 and NCSA
|
||||||
URL: http://www.php.net/
|
URL: http://www.php.net/
|
||||||
Source0: http://www.php.net/distributions/php-%{upver}%{?rcver}.tar.xz
|
Source0: http://www.php.net/distributions/php-%{upver}%{?rcver}.tar.xz
|
||||||
Source1: php.conf
|
Source1: php.conf
|
||||||
@ -48,15 +48,16 @@ Source50: 10-opcache.ini
|
|||||||
Source51: opcache-default.blacklist
|
Source51: opcache-default.blacklist
|
||||||
Source52: 20-ffi.ini
|
Source52: 20-ffi.ini
|
||||||
|
|
||||||
Patch0001: php-7.4.0-httpd.patch
|
Patch0: php-7.4.0-httpd.patch
|
||||||
Patch0002: php-7.2.0-includedir.patch
|
Patch1: php-7.2.0-includedir.patch
|
||||||
Patch0003: php-8.0.0-embed.patch
|
Patch2: php-8.0.0-embed.patch
|
||||||
Patch0004: php-7.4.0-libdb.patch
|
Patch3: php-7.4.0-libdb.patch
|
||||||
Patch0005: php-8.0.0-systzdata-v19.patch
|
Patch4: php-8.0.0-systzdata-v19.patch
|
||||||
Patch0006: php-7.4.0-phpize.patch
|
Patch5: php-7.4.0-phpize.patch
|
||||||
Patch0007: php-7.4.0-ldap_r.patch
|
Patch6: php-7.4.0-ldap_r.patch
|
||||||
Patch0008: php-8.0.0-phpinfo.patch
|
Patch7: php-8.0.0-phpinfo.patch
|
||||||
Patch0009: php-7.4.0-datetests.patch
|
Patch8: php-7.4.0-datetests.patch
|
||||||
|
Patch9: backport-CVE-2020-7071-Fix-bug-77423.patch
|
||||||
|
|
||||||
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
|
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
|
||||||
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
|
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
|
||||||
@ -1095,6 +1096,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Jan 29 2021 panxiaohe <panxiaohe@huawei.com> - 8.0.0-2
|
||||||
|
- Fix CVE-2020-7071
|
||||||
|
|
||||||
* Thu Dec 31 2020 panxiaohe <panxiaohe@huawei.com> - 8.0.0-1
|
* Thu Dec 31 2020 panxiaohe <panxiaohe@huawei.com> - 8.0.0-1
|
||||||
- Update to 8.0.0
|
- Update to 8.0.0
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user