Authentication could be bypassed if URI had multiple slashes

See tuupola/slim-jwt-auth#50
tuupola · Feb 27, 2017 · 392ddee · 392ddee
1 parent cc5a0cf
commit 392ddee
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 0 deletions.
diff --git a/src/HttpBasicAuthentication/RequestPathRule.php b/src/HttpBasicAuthentication/RequestPathRule.php
@@ -30,6 +30,7 @@ public function __construct($options = array())
     public function __invoke(\Slim\Slim $app)
     {
         $uri = $app->request->getResourceUri();
+        $uri = preg_replace("#/+#", "/", $uri);
 
         /* If request path is matches passthrough should not authenticate. */
         foreach ((array)$this->options["passthrough"] as $passthrough) {

diff --git a/test/RequestPathRuleTest.php b/test/RequestPathRuleTest.php
@@ -128,4 +128,44 @@ public function testShouldPassthroughLogin()
         ));
         $this->assertFalse($rule(new \Slim\Slim));
     }
+
+    public function testBug50ShouldAuthenticateMultipleSlashes()
+    {
+        \Slim\Environment::mock(array(
+            "SCRIPT_NAME" => "/index.php",
+            "PATH_INFO" => "/"
+        ));
+
+        $rule = new RequestPathRule(array("path" => "/v1/api"));
+        $this->assertFalse($rule(new \Slim\Slim));
+
+        \Slim\Environment::mock(array(
+            "SCRIPT_NAME" => "/index.php",
+            "PATH_INFO" => "/v1/api"
+        ));
+        $this->assertTrue($rule(new \Slim\Slim));
+
+        \Slim\Environment::mock(array(
+            "SCRIPT_NAME" => "/index.php",
+            "PATH_INFO" => "/v1//api"
+        ));
+        $this->assertTrue($rule(new \Slim\Slim));
+
+        \Slim\Environment::mock(array(
+            "SCRIPT_NAME" => "/index.php",
+            "PATH_INFO" => "/v1//////api"
+        ));
+        $this->assertTrue($rule(new \Slim\Slim));
+
+        \Slim\Environment::mock(array(
+            "SCRIPT_NAME" => "/index.php",
+            "PATH_INFO" => "//v1/api"
+        ));
+        $this->assertTrue($rule(new \Slim\Slim));
+
+        \Slim\Environment::mock(array(
+            "SCRIPT_NAME" => "/index.php",
+            "PATH_INFO" => "//////v1/api"
+        ));
+    }
 }