8000 security #cve-2020-5255 [HttpFoundation] Do not set the default Conte… · symfony/symfony@dca3434 · GitHub
[go: up one dir, main page]
Skip to content

Commit dca3434

Browse files
nicolas-grekasnicolas-grekas
committed
security #cve-2020-5255 [HttpFoundation] Do not set the default Content-Type based on the Accept header (yceruto)
This PR was merged into the 4.4 branch.
2 parents c935e4a + 0050a4d commit dca3434

File tree

4 files changed

+26
-4
lines changed

4 files changed

+26
-4
lines changed

‎src/Symfony/Component/ErrorHandler/ErrorRenderer/SerializerErrorRenderer.php

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\ErrorHandler\ErrorRenderer;
1313

1414
use Symfony\Component\ErrorHandler\Exception\FlattenException;
15+
use Symfony\Component\HttpFoundation\Request;
1516
use Symfony\Component\HttpFoundation\RequestStack;
1617
use Symfony\Component\Serializer\Exception\NotEncodableValueException;
1718
use Symfony\Component\Serializer\SerializerInterface;
@@ -30,6 +31,7 @@ class SerializerErrorRenderer implements ErrorRendererInterface
3031

3132
/**
3233
* @param string|callable(FlattenException) $format The format as a string or a callable that should return it
34+
* formats not supported by Request::getMimeTypes() should be given as mime types
3335
* @param bool|callable $debug The debugging mode as a boolean or a callable that should return it
3436
*/
3537
public function __construct(SerializerInterface $serializer, $format, ErrorRendererInterface $fallbackErrorRenderer = null, $debug = false)
@@ -57,11 +59,16 @@ public function render(\Throwable $exception): FlattenException
5759

5860
try {
5961
$format = \is_string($this->format) ? $this->format : ($this->format)($flattenException);
62+
$headers = [
63+
'Content-Type' => Request::getMimeTypes($format)[0] ?? $format,
64+
'Vary' => 'Accept',
65+
];
6066

6167
return $flattenException->setAsString($this->serializer->serialize($flattenException, $format, [
6268
'exception' => $exception,
6369
'debug' => \is_bool($this->debug) ? $this->debug : ($this->debug)($exception),
64-
]));
70+
]))
71+
->setHeaders($flattenException->getHeaders() + $headers);
6572
} catch (NotEncodableValueException $e) {
6673
return $this->fallbackErrorRenderer->render($exception);
6774
}

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1590,7 +1590,9 @@ public function isNoCache()
15901590
* Gets the preferred format for the response by inspecting, in the following order:
15911591
* * the request format set using setRequestFormat
15921592
* * the values of the Accept HTTP header
1593-
* * the content type of the body of the request.
1593+
*
1594+
* Note that if you use this method, you should send the "Vary: Accept" header
1595+
* in the response to prevent any issues with intermediary HTTP caches.
15941596
*/
15951597
public function getPreferredFormat(?string $default = 'html'): ?string
15961598
{

‎src/Symfony/Component/HttpFoundation/Response.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@ public function prepare(Request $request)
275275
} else {
276276
// Content-type based on the Request
277277
if (!$headers->has('Content-Type')) {
278-
$format = $request->getPreferredFormat(null);
278+
$format = $request->getRequestFormat(null);
279279
if (null !== $format && $mimeType = $request->getMimeType($format)) {
280280
$headers->set('Content-Type', $mimeType);
281281
}

‎src/Symfony/Component/HttpFoundation/Tests/ResponseTest.php

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -497,12 +497,25 @@ public function testPrepareDoesNothingIfRequestFormatIsNotDefined()
497497
$this->assertEquals('text/html; charset=UTF-8', $response->headers->get('content-type'));
498498
}
499499

500+
/**
501+
* Same URL cannot produce different Content-Type based on the value of the Accept header,
502+
* unless explicitly stated in the response object.
503+
*/
504+
public function testPrepareDoesNotSetContentTypeBasedOnRequestAcceptHeader()
505+
{
506+
$response = new Response('foo');
507+
$request = Request::create('/');
508+
$request->headers->set('Accept', 'application/json');
509+
$response->prepare($request);
510+
511+
$this->assertSame('text/html; charset=UTF-8', $response->headers->get('content-type'));
512+
}
513+
500514
public function testPrepareSetContentType()
501515
{
502516
$response = new Response('foo');
503517
$request = Request::create('/');
504518
$request->setRequestFormat('json');
505-
$request->headers->remove('accept');
506519

507520
$response->prepare($request);
508521

0 commit comments

Comments
 (0)
0