From 6be00432b75a80a246246883c5fa955ce803f3d8 Mon Sep 17 00:00:00 2001 From: Daniel Kesselberg Date: Mon, 30 Sep 2024 13:05:19 +0200 Subject: [PATCH] chore: always execute parse_url in preventLocalAddress This change should make it easier to spot wrong uses of the HTTP client on development setups where allow_local_remote_servers is usually true. Signed-off-by: Daniel Kesselberg --- lib/private/Http/Client/Client.php | 9 +++++---- tests/lib/Http/Client/ClientTest.php | 8 +++++++- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/lib/private/Http/Client/Client.php b/lib/private/Http/Client/Client.php index 40ce012cd1a0d..62209ff9040d1 100644 --- a/lib/private/Http/Client/Client.php +++ b/lib/private/Http/Client/Client.php @@ -158,14 +158,15 @@ private function isLocalAddressAllowed(array $options) : bool { } protected function preventLocalAddress(string $uri, array $options): void { - if ($this->isLocalAddressAllowed($options)) { - return; - } - $host = parse_url($uri, PHP_URL_HOST); if ($host === false || $host === null) { throw new LocalServerException('Could not detect any host'); } + + if ($this->isLocalAddressAllowed($options)) { + return; + } + if (!$this->remoteHostValidator->isValid($host)) { throw new LocalServerException('Host "' . $host . '" violates local access rules'); } diff --git a/tests/lib/Http/Client/ClientTest.php b/tests/lib/Http/Client/ClientTest.php index 237bb1299e526..47a6b885aed09 100644 --- a/tests/lib/Http/Client/ClientTest.php +++ b/tests/lib/Http/Client/ClientTest.php @@ -130,6 +130,13 @@ public function testGetProxyUriProxyHostWithPasswordAndExclude(): void { ], self::invokePrivate($this->client, 'getProxyUri')); } + public function testPreventLocalAddressThrowOnInvalidUri(): void { + $this->expectException(LocalServerException::class); + $this->expectExceptionMessage('Could not detect any host'); + + self::invokePrivate($this->client, 'preventLocalAddress', ['!@#$', []]); + } + public function dataPreventLocalAddress():array { return [ ['https://localhost/foo.bar'], @@ -146,7 +153,6 @@ public function dataPreventLocalAddress():array { ['https://10.0.0.1'], ['https://another-host.local'], ['https://service.localhost'], - ['!@#$', true], // test invalid url ['https://normal.host.com'], ['https://com.one-.nextcloud-one.com'], ];