Skip to content

Commit f092dd7

Browse files
GrahamCampbellTimWolla
GrahamCampbell
and
TimWolla
authored
[6.x] Fix cross-domain cookie leakage (#3017)
Co-authored-by: Tim Düsterhus <209270+TimWolla@users.noreply.github.com>
1 parent e8ed4db commit f092dd7

File tree

11 files changed

+176
-113
lines changed

11 files changed

+176
-113
lines changed

‎.gitattributes

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
1-
.editorconfig export-ignore
2-
.gitattributes export-ignore
1+
.editorconfig export-ignore
2+
.gitattributes export-ignore
33
/.github/ export-ignore
4-
.gitignore export-ignore
5-
/.travis.yml export-ignore
4+
.gitignore export-ignore
65
/build/ export-ignore
76
/docs/ export-ignore
87
/Makefile export-ignore

‎.github/workflows/ci.yml

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
9+
jobs:
10+
build-lowest:
11+
name: Build lowest
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Set up PHP
16+
uses: shivammathur/setup-php@v2
17+
with:
18+
php-version: '5.5'
19+
coverage: none
20+
extensions: mbstring, intl
21+
22+
- name: Set up Node
23+
uses: actions/setup-node@v1
24+
with:
25+
node-version: '14.x'
26+
27+
- name: Setup Problem Matchers for PHPUnit
28+
run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
29+
30+
- name: Checkout code
31+
uses: actions/checkout@v2
32+
33+
- name: Download dependencies
34+
run: composer update --no-interaction --no-progress --prefer-stable --prefer-lowest
35+
36+
- name: Run tests
37+
run: make test
38+
39+
build:
40+
name: Build
41+
runs-on: ubuntu-latest
42+
strategy:
43+
max-parallel: 10
44+
matrix:
45+
php: ['5.5', '5.6', '7.0', '7.1', '7.2', '7.3', '7.4']
46+
47+
steps:
48+
- name: Set up PHP
49+
uses: shivammathur/setup-php@v2
50+
with:
51+
php-version: ${{ matrix.php }}
52+
coverage: none
53+
extensions: mbstring, intl
54+
55+
- name: Set up Node
56+
uses: actions/setup-node@v1
57+
with:
58+
node-version: '14.x'
59+
60+
- name: Setup Problem Matchers for PHPUnit
61+
run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
62+
63+
- name: Checkout code
64+
uses: actions/checkout@v2
65+
66+
- name: Download dependencies
67+
run: composer update --no-interaction --no-progress
68+
69+
- name: Run tests
70+
run: make test

‎.github/workflows/static.yml

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎.travis.yml

Lines changed: 0 additions & 56 deletions
This file was deleted.

‎CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Change Log
22

3+
## 6.5.6 - 2022-05-25
4+
5+
* Fix cross-domain cookie leakage
6+
37
## 6.5.5 - 2020-06-16
48

59
* Unpin version constraint for `symfony/polyfill-intl-idn` [#2678](https://github.com/guzzle/guzzle/pull/2678)

‎LICENSE

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
1-
Copyright (c) 2011-2018 Michael Dowling, https://github.com/mtdowling <mtdowling@gmail.com>
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2011 Michael Dowling <mtdowling@gmail.com>
4+
Copyright (c) 2012 Jeremy Lindblom <jeremeamia@gmail.com>
5+
Copyright (c) 2014 Graham Campbell <hello@gjcampbell.co.uk>
6+
Copyright (c) 2015 Márk Sági-Kazár <mark.sagikazar@gmail.com>
7+
Copyright (c) 2015 Tobias Schultze <webmaster@tubo-world.de>
8+
Copyright (c) 2016 Tobias Nyholm <tobias.nyholm@gmail.com>
9+
Copyright (c) 2016 George Mponos <gmponos@gmail.com>
210

311
Permission is hereby granted, free of charge, to any person obtaining a copy
412
of this software and associated documentation files (the "Software"), to deal

‎README.md

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guzzle, PHP HTTP client
22
=======================
33

44
[![Latest Version](https://img.shields.io/github/release/guzzle/guzzle.svg?style=flat-square)](https://github.com/guzzle/guzzle/releases)
5-
[![Build Status](https://img.shields.io/travis/guzzle/guzzle.svg?style=flat-square)](https://travis-ci.org/guzzle/guzzle)
5+
[![Build Status](https://img.shields.io/github/workflow/status/guzzle/guzzle/CI?label=ci%20build&style=flat-square)](https://github.com/guzzle/guzzle/actions?query=workflow%3ACI)
66
[![Total Downloads](https://img.shields.io/packagist/dt/guzzlehttp/guzzle.svg?style=flat-square)](https://packagist.org/packages/guzzlehttp/guzzle)
77

88
Guzzle is a PHP HTTP client that makes it easy to send HTTP requests and
@@ -74,17 +74,20 @@ composer update
7474

7575
## Version Guidance
7676

77-
| Version | Status | Packagist | Namespace | Repo | Docs | PSR-7 | PHP Version |
78-
|---------|------------|---------------------|--------------|---------------------|---------------------|-------|-------------|
79-
| 3.x | EOL | `guzzle/guzzle` | `Guzzle` | [v3][guzzle-3-repo] | [v3][guzzle-3-docs] | No | >= 5.3.3 |
80-
| 4.x | EOL | `guzzlehttp/guzzle` | `GuzzleHttp` | [v4][guzzle-4-repo] | N/A | No | >= 5.4 |
81-
| 5.x | EOL | `guzzlehttp/guzzle` | `GuzzleHttp` | [v5][guzzle-5-repo] | [v5][guzzle-5-docs] | No | >= 5.4 |
82-
| 6.x | Latest | `guzzlehttp/guzzle` | `GuzzleHttp` | [v6][guzzle-6-repo] | [v6][guzzle-6-docs] | Yes | >= 5.5 |
77+
| Version | Status | Packagist | Namespace | Repo | Docs | PSR-7 | PHP Version |
78+
|---------|----------------|---------------------|--------------|---------------------|---------------------|-------|--------------|
79+
| 3.x | EOL | `guzzle/guzzle` | `Guzzle` | [v3][guzzle-3-repo] | [v3][guzzle-3-docs] | No | >=5.3.3,<7.0 |
80+
| 4.x | EOL | `guzzlehttp/guzzle` | `GuzzleHttp` | [v4][guzzle-4-repo] | N/A | No | >=5.4,<7.0 |
81+
| 5.x | EOL | `guzzlehttp/guzzle` | `GuzzleHttp` | [v5][guzzle-5-repo] | [v5][guzzle-5-docs] | No | >=5.4,<7.4 |
82+
| 6.x | Security fixes | `guzzlehttp/guzzle` | `GuzzleHttp` | [v6][guzzle-6-repo] | [v6][guzzle-6-docs] | Yes | >=5.5,<8.0 |
83+
| 7.x | Latest | `guzzlehttp/guzzle` | `GuzzleHttp` | [v7][guzzle-7-repo] | [v7][guzzle-7-docs] | Yes | >=7.2.5,<8.2 |
8384

8485
[guzzle-3-repo]: https://github.com/guzzle/guzzle3
8586
[guzzle-4-repo]: https://github.com/guzzle/guzzle/tree/4.x
8687
[guzzle-5-repo]: https://github.com/guzzle/guzzle/tree/5.3
87-
[guzzle-6-repo]: https://github.com/guzzle/guzzle
88+
[guzzle-6-repo]: https://github.com/guzzle/guzzle/tree/6.5
89+
[guzzle-7-repo]: https://github.com/guzzle/guzzle
8890
[guzzle-3-docs]: http://guzzle3.readthedocs.org
89-
[guzzle-5-docs]: http://guzzle.readthedocs.org/en/5.3/
90-
[guzzle-6-docs]: http://guzzle.readthedocs.org/en/latest/
91+
[guzzle-5-docs]: http://docs.guzzlephp.org/en/5.3/
92+
[guzzle-6-docs]: http://docs.guzzlephp.org/en/6.5/
93+
[guzzle-7-docs]: http://docs.guzzlephp.org/en/latest/

‎composer.json

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,40 @@
1414
"homepage": "http://guzzlephp.org/",
1515
"license": "MIT",
1616
"authors": [
17+
{
18+
"name": "Graham Campbell",
19+
"email": "hello@gjcampbell.co.uk",
20+
"homepage": "https://github.com/GrahamCampbell"
21+
},
1722
{
1823
"name": "Michael Dowling",
1924
"email": "mtdowling@gmail.com",
2025
"homepage": "https://github.com/mtdowling"
26+
},
27+
{
28+
"name": "Jeremy Lindblom",
29+
"email": "jeremeamia@gmail.com",
30+
"homepage": "https://github.com/jeremeamia"
31+
},
32+
{
33+
"name": "George Mponos",
34+
"email": "gmponos@gmail.com",
35+
"homepage": "https://github.com/gmponos"
36+
},
37+
{
38+
"name": "Tobias Nyholm",
39+
"email": "tobias.nyholm@gmail.com",
40+
"homepage": "https://github.com/Nyholm"
41+
},
42+
{
43+
"name": "Márk Sági-Kazár",
44+
"email": "mark.sagikazar@gmail.com",
45+
"homepage": "https://github.com/sagikazarmark"
46+
},
47+
{
48+
"name": "Tobias Schultze",
49+
"email": "webmaster@tubo-world.de",
50+
"homepage": "https://github.com/Tobion"
2151
}
2252
],
2353
"require": {

‎src/Cookie/CookieJar.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,11 @@ public function extractCookies(
240240
if (0 !== strpos($sc->getPath(), '/')) {
241241
$sc->setPath($this->getCookiePathFromRequest($request));
242242
}
243+
if (!$sc->matchesDomain($request->getUri()->getHost())) {
244+
continue;
245+
}
246+
// Note: At this point `$sc->getDomain()` being a public suffix should
247+
// be rejected, but we don't want to pull in the full PSL dependency.
243248
$this->setCookie($sc);
244249
}
245250
}

‎src/Cookie/SetCookie.php

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -333,12 +333,19 @@ public function matchesPath($requestPath)
333333
*/
334334
public function matchesDomain($domain)
335335
{
336+
$cookieDomain = $this->getDomain();
337+
if (null === $cookieDomain) {
338+
return true;
339+
}
340+
336341
// Remove the leading '.' as per spec in RFC 6265.
337342
// http://tools.ietf.org/html/rfc6265#section-5.2.3
338-
$cookieDomain = ltrim($this->getDomain(), '.');
343+
$cookieDomain = ltrim(strtolower($cookieDomain), '.');
344+
345+
$domain = strtolower($domain);
339346

340347
// Domain not set or exact match.
341-
if (!$cookieDomain || !strcasecmp($domain, $cookieDomain)) {
348+
if ('' === $cookieDomain || $domain === $cookieDomain) {
342349
return true;
343350
}
344351

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy