MessageSource::getMessageFilePath() - filename injection

framework/CHANGELOG.md

@@ -22,6 +22,7 @@ Yii Framework 2 Change Log
 - Enh #18899: Replace usages of `strpos` with `strncmp` and remove redundant usage of `array_merge` and `array_values` (AlexGx)
 - Bug #18898: Fix `yii\helpers\Inflector::camel2words()` to work with words ending with 0 (michaelarnauts)
 - Enh #18904: Improve Captcha client-side validation (hexkir)
+- Bug #18913: Fix filename injection for `MessageSource::getMessageFilePath()` (uaoleg)
 
 
 2.0.43 August 09, 2021

framework/i18n/GettextMessageSource.php

@@ -8,6 +8,7 @@
 namespace yii\i18n;
 
 use Yii;
+use yii\base\InvalidArgumentException;
 
 /**
  * GettextMessageSource represents a message source that is based on GNU Gettext.
@@ -129,6 +130,9 @@ protected function loadFallbackMessages($category, $fallbackLanguage, $messages,
      */
     protected function getMessageFilePath($language)
     {
+        if (!preg_match('/^[\w_-]+$/', $language)) {
+            throw new InvalidArgumentException('Invalid language code.');
+        }
         $messageFile = Yii::getAlias($this->basePath) . '/' . $language . '/' . $this->catalog;
         if ($this->useMoFile) {
             $messageFile .= self::MO_FILE_EXT;

framework/i18n/PhpMessageSource.php

@@ -8,6 +8,7 @@
 namespace yii\i18n;
 
 use Yii;
+use yii\base\InvalidArgumentException;
 
 /**
  * PhpMessageSource represents a message source that stores translated messages in PHP scripts.
@@ -132,6 +133,9 @@ protected function loadFallbackMessages($category, $fallbackLanguage, $messages,
      */
     protected function getMessageFilePath($category, $language)
     {
+        if (!preg_match('/^[\w_-]+$/', $language)) {
+            throw new InvalidArgumentException('Invalid language code.');
+        }
         $messageFile = Yii::getAlias($this->basePath) . "/$language/";
         if (isset($this->fileMap[$category])) {
             $messageFile .= $this->fileMap[$category];