diff options
author | Stanislav Malyshev <stas@php.net> | 2020-09-20 18:08:55 -0700 |
---|---|---|
committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-09-29 09:50:07 +0200 |
commit | 78c2deb356344482ec9a84abfbd7ec1c63e0dc73 (patch) | |
tree | e27769d7c772de5faf455304eb64d45f1508f629 | |
parent | de777c8fd22807c2121775e0f936336dc34a01a4 (diff) | |
download | php-git-78c2deb356344482ec9a84abfbd7ec1c63e0dc73.tar.gz |
Do not decode cookie names anymore
(cherry picked from commit 95e1a415a50b6bdcf031915f3bb3d7dffa1718b8)
-rw-r--r-- | NEWS | 2 | ||||
-rw-r--r-- | UPGRADING | 5 | ||||
-rw-r--r-- | main/php_variables.c | 8 | ||||
-rw-r--r-- | tests/basic/022.phpt | 10 | ||||
-rw-r--r-- | tests/basic/023.phpt | 4 | ||||
-rw-r--r-- | tests/basic/bug79699.phpt | 22 |
6 files changed, 45 insertions, 6 deletions
@@ -6,6 +6,8 @@ PHP NEWS . Fixed bug #80048 (Bug #69100 has not been fixed for Windows). (cmb) . Fixed bug #80049 (Memleak when coercing integers to string via variadic argument). (Nikita) + . Fixed bug ##79699 (PHP parses encoded cookie names so malicious `__Host-` + cookies can be sent). (CVE-2020-7070) (Stas) - Calendar: . Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing). @@ -151,6 +151,11 @@ Reflection: . Reflection export to string now uses `int` and `bool` instead of `integer` and `boolean`. +SAPI: + . Starting with 7.3.24, incoming cookie names are not url-decoded. This was never + required by the standard, outgoing cookie names aren't encoded and this leads + to security issues (CVE-2020-7070). + SPL: . If an SPL autoloader throws an exception, following autoloaders will not be executed. Previously all autoloaders were executed and exceptions were diff --git a/main/php_variables.c b/main/php_variables.c index d804a3860f..ca015352d2 100644 --- a/main/php_variables.c +++ b/main/php_variables.c @@ -501,7 +501,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data) size_t new_val_len; *val++ = '\0'; - php_url_decode(var, strlen(var)); + if (arg != PARSE_COOKIE) { + php_url_decode(var, strlen(var)); + } val_len = php_url_decode(val, strlen(val)); val = estrndup(val, val_len); if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len)) { @@ -512,7 +514,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data) size_t val_len; size_t new_val_len; - php_url_decode(var, strlen(var)); + if (arg != PARSE_COOKIE) { + php_url_decode(var, strlen(var)); + } val_len = 0; val = estrndup("", val_len); if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len)) { diff --git a/tests/basic/022.phpt b/tests/basic/022.phpt index 0ab70d4be7..bd1db13701 100644 --- a/tests/basic/022.phpt +++ b/tests/basic/022.phpt @@ -10,7 +10,7 @@ cookie1=val1 ; cookie2=val2%20; cookie3=val 3.; cookie 4= value 4 %3B; cookie1= var_dump($_COOKIE); ?> --EXPECT-- -array(10) { +array(12) { ["cookie1"]=> string(6) "val1 " ["cookie2"]=> @@ -19,11 +19,15 @@ array(10) { string(6) "val 3." ["cookie_4"]=> string(10) " value 4 ;" + ["%20cookie1"]=> + string(6) "ignore" + ["+cookie1"]=> + string(6) "ignore" ["cookie__5"]=> string(7) " value" - ["cookie_6"]=> + ["cookie%206"]=> string(3) "þæö" - ["cookie_7"]=> + ["cookie+7"]=> string(0) "" ["$cookie_8"]=> string(0) "" diff --git a/tests/basic/023.phpt b/tests/basic/023.phpt index ca5f1dcfbb..0e2e0ac669 100644 --- a/tests/basic/023.phpt +++ b/tests/basic/023.phpt @@ -10,9 +10,11 @@ c o o k i e=value; c o o k i e= v a l u e ;;c%20o+o k+i%20e=v;name="value","valu var_dump($_COOKIE); ?> --EXPECT-- -array(3) { +array(4) { ["c_o_o_k_i_e"]=> string(5) "value" + ["c%20o+o_k+i%20e"]=> + string(1) "v" ["name"]=> string(24) ""value","value",UEhQIQ==" ["UEhQIQ"]=> diff --git a/tests/basic/bug79699.phpt b/tests/basic/bug79699.phpt new file mode 100644 index 0000000000..fc3d3fedb0 --- /dev/null +++ b/tests/basic/bug79699.phpt @@ -0,0 +1,22 @@ +--TEST-- +Cookies Security Bug +--INI-- +max_input_vars=1000 +filter.default=unsafe_raw +--COOKIE-- +__%48ost-evil=evil; __Host-evil=good; %66oo=baz;foo=bar +--FILE-- +<?php +var_dump($_COOKIE); +?> +--EXPECT-- +array(4) { + ["__%48ost-evil"]=> + string(4) "evil" + ["__Host-evil"]=> + string(4) "good" + ["%66oo"]=> + string(3) "baz" + ["foo"]=> + string(3) "bar" +} |