Skip to content
Permalink
Browse files

Disallow controller names with / in them.

Controller names should not be allowed to have / in them. Internally we
convert / into \\ which allows arbitrary namespace creation through what
should be controlled parameters. While the default routing normally
prevents / getting into a controller name, we cannot make the same
assumptions with PSR7 middleware.
  • Loading branch information...
markstory committed Apr 16, 2016
1 parent 389415f commit 50dcf3b52e6470ff19a6a89fd23e1f80db8fb8f1
Showing with 24 additions and 4 deletions.
  1. +7 −4 src/Http/ControllerFactory.php
  2. +17 −0 tests/TestCase/Http/ControllerFactoryTest.php
@@ -55,16 +55,19 @@ public function create(Request $request, Response $response)
}
}
$firstChar = substr($controller, 0, 1);
// Disallow plugin short forms, / and \\ from
// controller names as they allow direct references to
// be created.
if (strpos($controller, '\\') !== false ||
strpos($controller, '/') !== false ||
strpos($controller, '.') !== false ||
$firstChar === strtolower($firstChar)
) {
return $this->missingController($request);
}
$className = false;
if ($pluginPath . $controller) {
$className = App::classname($pluginPath . $controller, $namespace, 'Controller');
}
$className = App::classname($pluginPath . $controller, $namespace, 'Controller');
if (!$className) {
return $this->missingController($request);
}
@@ -230,6 +230,23 @@ public function testMissingClassFailure()
$this->factory->create($request, $this->response);
}
/**
* @expectedException \Cake\Routing\Exception\MissingControllerException
* @expectedExceptionMessage Controller class Admin/Posts could not be found.
* @return void
*/
public function testSlashedControllerFailure()
{
$request = new Request([
'url' => 'admin/posts/index',
'params' => [
'controller' => 'Admin/Posts',
'action' => 'index',
]
]);
$this->factory->create($request, $this->response);
}
/**
* @expectedException \Cake\Routing\Exception\MissingControllerException
* @expectedExceptionMessage Controller class TestApp\Controller\CakesController could not be found.

0 comments on commit 50dcf3b

Please sign in to comment.
You can’t perform that action at this time.