diff options
| author | Joas Schilling <coding@schilljs.com> | 2023-12-04 10:38:46 +0100 |
|---|---|---|
| committer | backportbot-nextcloud[bot] <backportbot-nextcloud[bot]@users.noreply.github.com> | 2023-12-04 11:18:51 +0000 |
| commit | 704751f86831621dec1da588e0b62f815831d55c (patch) | |
| tree | 6d32a918575aa863a5a361123de53fbd9b936e8b /lib/private | |
| parent | 0744821ebfa2ac66299d44390a7d1027fbda679d (diff) | |
| download | nextcloud-server-704751f86831621dec1da588e0b62f815831d55c.tar.gz nextcloud-server-704751f86831621dec1da588e0b62f815831d55c.zip | |
fix(security): Handle idn_to_utf8 returning false
Signed-off-by: Joas Schilling <coding@schilljs.com>
Diffstat (limited to 'lib/private')
| -rw-r--r-- | lib/private/Security/RemoteHostValidator.php | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/private/Security/RemoteHostValidator.php b/lib/private/Security/RemoteHostValidator.php index 385b38cff98..9cc69594c32 100644 --- a/lib/private/Security/RemoteHostValidator.php +++ b/lib/private/Security/RemoteHostValidator.php @@ -52,6 +52,10 @@ final class RemoteHostValidator implements IRemoteHostValidator { } $host = idn_to_utf8(strtolower(urldecode($host))); + if ($host === false) { + return false; + } + // Remove brackets from IPv6 addresses if (str_starts_with($host, '[') && str_ends_with($host, ']')) { $host = substr($host, 1, -1); |