Merge pull request #16199 from nextcloud/bugfix/noid/refresh_webcal_job_enhancements

RefreshWebcalJob: replace ugly Regex with standard php utils
This commit is contained in:
Morris Jobke 2019-07-02 23:02:25 +02:00 committed by GitHub
commit c32f14e443
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 3 deletions

View File

@ -225,14 +225,25 @@ class RefreshWebcalJob extends Job {
} }
if ($allowLocalAccess !== 'yes') { if ($allowLocalAccess !== 'yes') {
$host = parse_url($url, PHP_URL_HOST); $host = strtolower(parse_url($url, PHP_URL_HOST));
// remove brackets from IPv6 addresses // remove brackets from IPv6 addresses
if (strpos($host, '[') === 0 && substr($host, -1) === ']') { if (strpos($host, '[') === 0 && substr($host, -1) === ']') {
$host = substr($host, 1, -1); $host = substr($host, 1, -1);
} }
if ($host === 'localhost' || substr($host, -6) === '.local' || substr($host, -10) === '.localhost' || // Disallow localhost and local network
preg_match('/(^127\.)|(^192\.168\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^::1$)|(^[fF][cCdD])/', $host)) { if ($host === 'localhost' || substr($host, -6) === '.local' || substr($host, -10) === '.localhost') {
$this->logger->warning("Subscription $subscriptionId was not refreshed because it violates local access rules");
return null;
}
// Disallow hostname only
if (substr_count($host, '.') === 0) {
$this->logger->warning("Subscription $subscriptionId was not refreshed because it violates local access rules");
return null;
}
if ((bool)filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
$this->logger->warning("Subscription $subscriptionId was not refreshed because it violates local access rules"); $this->logger->warning("Subscription $subscriptionId was not refreshed because it violates local access rules");
return null; return null;
} }

View File

@ -231,8 +231,14 @@ class RefreshWebcalJobTest extends TestCase {
public function runLocalURLDataProvider():array { public function runLocalURLDataProvider():array {
return [ return [
['localhost/foo.bar'], ['localhost/foo.bar'],
['localHost/foo.bar'],
['random-host/foo.bar'],
['[::1]/bla.blub'], ['[::1]/bla.blub'],
['[::]/bla.blub'],
['192.168.0.1'], ['192.168.0.1'],
['172.16.42.1'],
['[fdf8:f53b:82e4::53]/secret.ics'],
['[fe80::200:5aee:feaa:20a2]/secret.ics'],
['10.0.0.1'], ['10.0.0.1'],
['another-host.local'], ['another-host.local'],
['service.localhost'], ['service.localhost'],