Filter out invalid characters server side

[freekmurze]

Only alphanumeric characters and a . should be accepted. Let's just filter those out.

[brendt]

We're going to need a little more than just alphanumeric characters and a ., eg. - and _.

This post (which is based on the URI spec) lists a lot more: https://stackoverflow.com/questions/1547899/which-characters-make-a-url-invalid/1547940#1547940

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~:/?#[]@!$&'()*+,;=`.

All of these are valid URI characters. ? eg. doesn't make sense in a domain name, but people could still paste a whole URL, which should be able to be parsed. I think PHP's parse_url might actually be a good solution, because than you shouldn't worry about parsing the input at all. If it's a valid URL, parse_url($url, PHP_URL_HOST) will return the host, otherwise it will return null. http:// or https:// should be present though.

[bbashy]

@brendt It removes those https://github.com/spatie/dnsrecords.io/blob/master/app/Http/Controllers/HomeController.php#L81

[willemvb]

Side note: what with top level domains?
Eg. . as first character might need some extra attention:

• be currently works
• . currently works
• .be fails

[brendt]

@bbashy that's perfect, no?

protected function sanitizeInput(string $input = ''): string
{
    $input = str_replace(['http://', 'https://'], '', $input);

    $input = parse_url("http://{$input}", PHP_URL_HOST);

    return strtolower($input);
}

[bbashy]

@brendt Yeah something like that is fine apart from you need to remove http(s):// since dig doesn't accept it.

[bbashy]

Not like #9

[brendt]

@bbashy parse_url also automatically filters out http:// and https://. You just have to make sure the protocol is there to be able to parse it: https://3v4l.org/8nqnA

[brendt]

Also @willemvb parse_url addresses that issue: https://3v4l.org/CI9pp

[bbashy]

Ah yeah, of course!

[brendt]

@willemvb I was wrong about parse_url addressing the be issue.

To be complete:

• .be is not a valid domain, but for better user experience, it should work and be filtered.
• be. is a valid domain, but doesn't work with parse_url.
• . also doesn't work, but is a valid domain (the root domain). This exception should also work.

So these three exceptions should be handled before parse_url; but maybe than parse_url might not be needed at all.

[freekmurze]

Fixed in #9