Permalink
Browse files

Sanitizing path in Dispatcher::baseUrl(), fixes #6336, misc. whitespa…

…ce fixes.

git-svn-id: https://svn.cakephp.org/repo/branches/1.2.x.x@8165 3807eeeb-6ff5-0310-8944-8be069107fe0
  • Loading branch information...
1 parent be7ade3 commit 8369a8f2d88f62c332d0a179c5ff54307a74e7be @nateabele nateabele committed May 4, 2009
Showing with 37 additions and 7 deletions.
  1. +2 −1 cake/dispatcher.php
  2. +4 −1 cake/libs/model/model.php
  3. +17 −0 cake/tests/cases/dispatcher.test.php
  4. +14 −5 cake/tests/cases/libs/router.test.php
View
3 cake/dispatcher.php
@@ -344,7 +344,8 @@ function baseUrl() {
return $this->base = $base;
}
if (!$baseUrl) {
- $base = dirname(env('PHP_SELF'));
+ $replace = array('<', '>', '*', '\'', '"');
+ $base = str_replace($replace, '', dirname(env('PHP_SELF')));
if ($webroot === 'webroot' && $webroot === basename($base)) {
$base = dirname($base);
View
5 cake/libs/model/model.php
@@ -1010,7 +1010,10 @@ function read($fields = null, $id = null) {
}
if ($id !== null && $id !== false) {
- $this->data = $this->find(array($this->alias . '.' . $this->primaryKey => $id), $fields);
+ $this->data = $this->find('first', array(
+ 'conditions' => array($this->alias . '.' . $this->primaryKey => $id),
+ 'fields' => $fields
+ ));
return $this->data;
} else {
return false;
View
17 cake/tests/cases/dispatcher.test.php
@@ -1898,6 +1898,23 @@ function testHttpMethodOverrides() {
unset($_POST['_method']);
}
+
+/**
+ * Tests that invalid characters cannot be injected into the application base path.
+ *
+ * @return void
+ */
+ function testBasePathInjection() {
+ $self = $_SERVER['PHP_SELF'];
+ $_SERVER['PHP_SELF'] = urldecode(
+ "/index.php/%22%3E%3Ch1%20onclick=%22alert('xss');%22%3Eheya%3C/h1%3E"
+ );
+
+ $dispatcher =& new Dispatcher();
+ $result = $dispatcher->baseUrl();
+ $expected = '/index.php/h1 onclick=alert(xss);heya';
+ $this->assertEqual($result, $expected);
+ }
/**
* testEnvironmentDetection method
*
View
19 cake/tests/cases/libs/router.test.php
@@ -658,14 +658,23 @@ function testUrlGeneration() {
Router::reload();
Router::setRequestInfo(array(
- array('plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'admin_edit', 'pass' =>
- array(0 => '6'), 'prefix' => 'admin', 'admin' => true, 'form' => array(), 'url' =>
- array('url' => 'admin/shows/show_tickets/edit/6')),
- array('plugin' => NULL, 'controller' => NULL, 'action' => NULL, 'base' => '', 'here' => '/admin/shows/show_tickets/edit/6', 'webroot' => '/')));
+ array(
+ 'plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'admin_edit',
+ 'pass' => array('6'), 'prefix' => 'admin', 'admin' => true, 'form' => array(),
+ 'url' => array('url' => 'admin/shows/show_tickets/edit/6')
+ ),
+ array(
+ 'plugin' => null, 'controller' => null, 'action' => null, 'base' => '',
+ 'here' => '/admin/shows/show_tickets/edit/6', 'webroot' => '/'
+ )
+ ));
Router::parse('/');
- $result = Router::url(array('plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'edit', 'id' => '6', 'admin' => true, 'prefix' => 'admin', ));
+ $result = Router::url(array(
+ 'plugin' => 'shows', 'controller' => 'show_tickets', 'action' => 'edit', 'id' => '6',
+ 'admin' => true, 'prefix' => 'admin'
+ ));
$expected = '/admin/shows/show_tickets/edit/6';
$this->assertEqual($result, $expected);
}

0 comments on commit 8369a8f

Please sign in to comment.