search

dxw / whippet-server

Whippet Server launches a stand-alone web server for a specific WordPress installation. It makes WordPress easier to develop with, for example, by adding lots of debug information to the terminal without cluttering up or breaking your templates.
ISC License
80 stars 6 forks source link

Normalise path component of request URI #66

Closed mallorydxw closed 7 years ago

mallorydxw commented 8 years ago

This was previously allowing malicious requests like the following: GET /../../../etc/passwd HTTP/1.1.

Resolves: https://dxw.zendesk.com/agent/tickets/5659

mallorydxw commented 8 years ago

Note that whippet-sever now depends on php-intl and php-curl (those are the package names in Ubuntu).

harry-m commented 8 years ago

Can we avoid that dependency? It's a pain in the arse on OSX, requires a PECL package to be installed which itself depends on a library (ICU) that needs to be installed independently.

mallorydxw commented 8 years ago

Assign the ticket back to me and I'll take a look at what other URI-manipulation libraries are available.

mallorydxw commented 8 years ago

Updated the PR to use sabre/uri instead of league/uri.

harry-m commented 8 years ago

Are there updated instructions for getting it working?

I pulled, ran composer install, started a server and got:

Fatal error: Uncaught Error: Call to undefined function Uri\parse() in /Users/harry/Projects/tools/whippet-server/lib/whippet.class.php:247 Stack trace: #0 /Users/harry/Projects/tools/whippet-server/lib/router.php(10): Whippet->run() #1 {main} thrown in /Users/harry/Projects/tools/whippet-server/lib/whippet.class.php on line 247

on the page I visited.

mallorydxw commented 8 years ago

The namespace is Sabre\Uri but in this PR I've written \Uri instead. How did that happen. I wonder if I was accidentally testing with an older commit?

mallorydxw commented 8 years ago

Okay, this should be working now. I tested it.

harry-m commented 7 years ago

I get a notice about requested_uri now...

Notice: Undefined property: Whippet::$requested_uri in /Users/harry/Projects/tools/whippet-server/lib/whippet.class.php on line 264