Zend\Uri\Exception\InvalidUriPartException: Host "[IP ADDRESS]" is not valid or is not accepted by Zend\Uri\Http

[parkbot]

Bug Report

Q	A
Version(s)	^2.7

Summary

Laminas\Uri\Exception\InvalidUriPartException: Host "[IP ADDRESS]" is not valid or is not accepted by Laminas\Uri\Http

Current behavior

When certain requests are made a 500 server error is produced.

This appears to be happening on AWS servers hosting zend framework see:

https://magento.stackexchange.com/questions/299596/getting-error-php-fatal-error-uncaught-zend-uri-exception-invaliduripartexcept

https://serverfault.com/questions/996647/getting-error-php-fatal-error-uncaught-zend-uri-exception-invaliduripartexcept

We are also experiencing the error on our Zend Framework site when a set of requests are being sent from an AWS Security Scanner:

44.225.84.206 - - [10/Mar/2020:13:27:06 +0000] "GET http://[::ffff:a9fe:a9fe]/ HTTP/1.1" 500 - "-" "AWS Security Scanner"

The problem is with these lines of code starting on line 298 in /src/PhpEnvironment/Request.php

            // Check for missinterpreted IPv6-Address
            // Reported at least for Safari on Windows
            if (isset($this->serverParams['SERVER_ADDR']) && preg_match('/^\[[0-9a-fA-F\:]+\]$/', $host)) {
                $host = '[' . $this->serverParams['SERVER_ADDR'] . ']';
                if ($port . ']' == substr($host, strrpos($host, ':') + 1)) {
                    // The last digit of the IPv6-Address has been taken as port
                    // Unset the port so the default port can be used
                    $port = null;
                }
            }

How to reproduce

<?php

use PHPUnit\Framework\TestCase;
//use Zend\Http\PhpEnvironment\Request;
use \Laminas\Http\PhpEnvironment\Request;

class Test extends TestCase
{
    public function testInvalidHost()
    {
        $_SERVER = [
            'SCRIPT_NAME'           => '',
            'SERVER_ADDR'           => '10.0.33.135',
            'SERVER_NAME'           => '[::ffff:a9fe:a9fe]',
       ];
        $request = new Request();

    }

}

Expected behavior

The host should be null, 10.0.33.135, or [::ffff:a9fe:a9fe] not [10.0.33.135]

[SewHappy58]

I'm having the same issue with Cloudways Hosting. However, mine is when I try to apply Cart2Cart to migrate my M1 site to M2. I'm currently on Siteground but was going to migrate to Cloudways with the new M2. Both hosting company and Cart2Cart can't figure out the solution.

[kossanah]

I'm having the same issue with Cloudways Hosting. However, mine is when I try to apply Cart2Cart to migrate my M1 site to M2. I'm currently on Siteground but was going to migrate to Cloudways with the new M2. Both hosting company and Cart2Cart can't figure out the solution.

I have this same issue with Cloudway Host after upgrading to Magento 2.4.1. Pls did you get it resolved?

[Ocramius]

@kossanah I suggest sending a patch with a failing test case, then it should be fixable.

What's missing from the above test case is an expectation/assertion.

[parkbot]

Here is the test case with an assertion:

<?php

use Laminas\Http\PHPEnvironment\Request;
use PHPUnit\Framework\TestCase;

class Test extends TestCase
{

    public function testInvalidHost()
    {
        $_SERVER = [
            'SCRIPT_NAME' => '',
            'SERVER_ADDR' => '10.0.33.135',
            'SERVER_NAME' => '[::ffff:a9fe:a9fe]',
        ];
        $request = new Request();
        $this->assertInstanceOf(Request::class, $request);
    }
}

[Ocramius]

$this->assertInstanceOf(Request::class, $request);

That... will fail static analysis as a redundant condition :D

What would an ipv6 server name imply from a request API perspective? Is it discarded? Is it still visible in $request->server()? What's the URI to be rendered like?

[parkbot]

That is a good question, we don't discard an ipv4 SERVER_NAME, why would we discard a properly formatted ipv6 SERVER_NAME. The problem occurs because we assume the SERVER_ADDR is ipv6 because the SERVER_NAME is ipv6 while attempting to correct a bug in Safari on Windows. It seems wrong that a properly formatted ipv6 address would fail because we attempted to fix a possible bug.

[weierophinney]

This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering Committee. If you have a security issue, please follow our security reporting guidelines. If you wish to take on the role of maintainer, please nominate yourself

You can continue using laminas/laminas-http safely. Its successor will be PSR-7 in a later revision of laminas/laminas-mvc.