Make getServerHost more robust to faulty user input

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php
index 3563ce3a2005eed9ef740d1d18123e803e8e9138..6554250902d6966c52fcbddbb30a2683c8960e45 100644 (file)
--- a/lib/private/AppFramework/Http/Request.php
+++ b/lib/private/AppFramework/Http/Request.php
@@ -904,14 +904,14 @@ class Request implements \ArrayAccess, \Countable, IRequest {
                $trustedDomainHelper = new TrustedDomainHelper($this->config);
                if ($trustedDomainHelper->isTrustedDomain($host)) {
                        return $host;
-               } else {
-                       $trustedList = $this->config->getSystemValue('trusted_domains', []);
-                       if(!empty($trustedList)) {
-                               return $trustedList[0];
-                       } else {
-                               return '';
-                       }
                }
+
+               $trustedList = (array)$this->config->getSystemValue('trusted_domains', []);
+               if (count($trustedList) > 0) {
+                       return reset($trustedList);
+               }
+
+               return '';
        }
 
        /**

diff --git a/tests/lib/AppFramework/Http/RequestTest.php b/tests/lib/AppFramework/Http/RequestTest.php
index 56982aaf5117b807197c8b577b7006c9aec6e202..be019050e1bc08b2e3c401208f16bdf4399b510f 100644 (file)
--- a/tests/lib/AppFramework/Http/RequestTest.php
+++ b/tests/lib/AppFramework/Http/RequestTest.php
@@ -1222,6 +1222,52 @@ class RequestTest extends \Test\TestCase {
                $this->assertSame('',  $request->getServerHost());
        }
 
+       /**
+        * @return array
+        */
+       public function dataGetServerHostTrustedDomain() {
+               return [
+                       'is array' => ['my.trusted.host', ['my.trusted.host']],
+                       'is array but undefined index 0' => ['my.trusted.host', [2 => 'my.trusted.host']],
+                       'is string' => ['my.trusted.host', 'my.trusted.host'],
+                       'is null' => ['', null],
+               ];
+       }
+
+       /**
+        * @dataProvider dataGetServerHostTrustedDomain
+        * @param $expected
+        * @param $trustedDomain
+        */
+       public function testGetServerHostTrustedDomain($expected, $trustedDomain) {
+               $this->config
+                       ->method('getSystemValue')
+                       ->willReturnCallback(function ($key, $default) use ($trustedDomain) {
+                               if ($key === 'trusted_proxies') {
+                                       return ['1.2.3.4'];
+                               }
+                               if ($key === 'trusted_domains') {
+                                       return $trustedDomain;
+                               }
+                               return $default;
+                       });
+
+               $request = new Request(
+                       [
+                               'server' => [
+                                       'HTTP_X_FORWARDED_HOST' => 'my.untrusted.host',
+                                       'REMOTE_ADDR' => '1.2.3.4',
+                               ],
+                       ],
+                       $this->secureRandom,
+                       $this->config,
+                       $this->csrfTokenManager,
+                       $this->stream
+               );
+
+               $this->assertSame($expected, $request->getServerHost());
+       }
+
        public function testGetOverwriteHostDefaultNull() {
                $this->config
                        ->expects($this->once())