8000 minor #25296 [WebProfiler] Disallow viewing dot-files in Profiler (cu… · symfony/symfony@8a4bb79 · GitHub
[go: up one dir, main page]
Skip to content

Commit 8a4bb79

Browse files
fabpotfabpot
committed
minor #25296 [WebProfiler] Disallow viewing dot-files in Profiler (curry684)
This PR was merged into the 3.3 branch. Discussion ---------- [WebProfiler] Disallow viewing dot-files in Profiler | Q | A | ------------- | --- | Branch? | 3.3 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | License | MIT The file viewer in the profiler should not open files that were specifically intended to be hidden, like specifically .env files, but similarly files like .htaccess that might expose server configuration knowledge. Added tests validating both the new and old behavior. Commits ------- 6a2f518 Disallow viewing dot-files in Profiler
2 parents 93e136b + 6a2f518 commit 8a4bb79

File tree

2 files changed

+38
-1
lines changed

2 files changed

+38
-1
lines changed

‎src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -385,7 +385,7 @@ public function openAction(Request $request)
385385

386386
$filename = $this->baseDir.DIRECTORY_SEPARATOR.$file;
387387

388-
if (preg_match("'(^|[/\\\\])\.\.?([/\\\\]|$)'", $file) || !is_readable($filename)) {
388+
if (preg_match("'(^|[/\\\\])\.'", $file) || !is_readable($filename)) {
389389
throw new NotFoundHttpException(sprintf('The file "%s" cannot be opened.', $file));
390390
}
391391

‎src/Symfony/Bundle/WebProfilerBundle/Tests/Controller/ProfilerControllerTest.php

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
use PHPUnit\Framework\TestCase;
1515
use Symfony\Bundle\WebProfilerBundle\Controller\ProfilerController;
1616
use Symfony\Bundle\WebProfilerBundle\Csp\ContentSecurityPolicyHandler;
17+
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
1718
use Symfony\Component\HttpKernel\Profiler\Profile;
1819
use Symfony\Component\HttpFoundation\Request;
1920

@@ -46,6 +47,42 @@ public function getEmptyTokenCases()
4647
);
4748
}
4849

50+
/**
51+
* @dataProvider getOpenFileCases
52+
*/
53+
public function testOpeningDisallowedPaths($path, $isAllowed)
54+
{
55+
$urlGenerator = $this->getMockBuilder('Symfony\Component\Routing\Generator\UrlGeneratorInterface')->getMock();
56+
$twig = $this->getMockBuilder('Twig\Environment')->disableOriginalConstructor()->getMock();
57+
$profiler = $this
58+
->getMockBuilder('Symfony\Component\HttpKernel\Profiler\Profiler')
59+
->disableOriginalConstructor()
60+
->getMock();
61+
62+
$controller = new ProfilerController($urlGenerator, $profiler, $twig, array(), 'bottom', null, __DIR__.'/../..');
63+
64+
try {
65+
$response = $controller->openAction(Request::create('/_wdt/open', Request::METHOD_GET, array('file' => $path)));
66+
$this->assertEquals(200, $response->getStatusCode());
67+
$this->assertTrue($isAllowed);
68+
} catch (NotFoundHttpException $e) {
69+
$this->assertFalse($isAllowed);
70+
}
71+
}
72+
73+
public function getOpenFileCases()
74+
{
75+
return array(
76+
array('README.md', true),
77+
array('composer.json', true),
78+
array('Controller/ProfilerController.php', true),
79+
array('.gitignore', false),
80+
array('../TwigBundle/README.md', false),
81+
array('Controller/../README.md', false),
82+
array('Controller/./ProfilerController.php', false),
83+
);
84+
}
85+
4986
/**
5087
* @dataProvider provideCspVariants
5188
*/

0 commit comments

Comments
 (0)
0