Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 34f6a40

Browse files
nicolas-grekasnicolas-grekas
committed
Merge branch '3.4' into 4.1
* 3.4: [Security\Http] detect bad redirect targets using backslashes [Form] Filter file uploads out of regular form types Fix CI minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas) [travis] fix composer.lock invalidation for PRs patching several components [travis] fix composer.lock invalidation for deps=low minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas) [travis] ignore ordering when validating composer.lock files for deps=low minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas) fix ci [travis] fix requiring mongodb/mongodb before composer up minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas) [2.7] Make CI green updated VERSION for 2.7.49 updated CHANGELOG for 2.7.49 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer [HttpFoundation] Remove support for legacy and risky HTTP headers updated VERSION for 2.7.48 update CONTRIBUTORS for 2.7.48 updated CHANGELOG for 2.7.48
2 parents 5fc7d5e + 3aaa5ab commit 34f6a40

File tree

10 files changed

+57
-13
lines changed

10 files changed

+57
-13
lines changed

‎src/Symfony/Component/Form/Extension/Core/Type/FileType.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ public function configureOptions(OptionsResolver $resolver)
105105
'data_class' => $dataClass,
106106
'empty_data' => $emptyData,
107107
'multiple' => false,
108+
'allow_file_upload' => true,
108109
));
109110
}
110111

‎src/Symfony/Component/Form/Extension/Core/Type/FormType.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ public function configureOptions(OptionsResolver $resolver)
179179
'attr' => array(),
180180
'post_max_size_message' => 'The uploaded file was too large. Please try to upload a smaller file.',
181181
'upload_max_size_message' => $uploadMaxSizeMessage, // internal
182+
'allow_file_upload' => false,
182183
'help' => null,
183184
));
184185

‎src/Symfony/Component/Form/Form.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -532,6 +532,11 @@ public function submit($submittedData, $clearMissing = true)
532532
$submittedData = null;
533533
} elseif (is_scalar($submittedData)) {
534534
$submittedData = (string) $submittedData;
535+
} elseif ($this->config->getOption('allow_file_upload')) {
536+
// no-op
537+
} elseif ($this->config->getRequestHandler()->isFileUpload($submittedData)) {
538+
$submittedData = null;
539+
$this->transformationFailure = new TransformationFailedException('Submitted data was expected to be text or number, file upload given.');
535540
}
536541

537542
$dispatcher = $this->config->getEventDispatcher();
@@ -541,6 +546,10 @@ public function submit($submittedData, $clearMissing = true)
541546
$viewData = null;
542547

543548
try {
549+
if (null !== $this->transformationFailure) {
550+
throw $this->transformationFailure;
551+
}
552+
544553
// Hook to change content of the data submitted by the browser
545554
if ($dispatcher->hasListeners(FormEvents::PRE_SUBMIT)) {
546555
$event = new FormEvent($this, $submittedData);

‎src/Symfony/Component/Form/Tests/CompoundFormTest.php

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -709,7 +709,7 @@ public function testSubmitPostOrPutRequestWithSingleChildForm($method)
709709
'REQUEST_METHOD' => $method,
710710
));
711711

712-
$form = $this->getBuilder('image')
712+
$form = $this->getBuilder('image', null, null, array('allow_file_upload' => true))
713713
->setMethod($method)
714714
->setRequestHandler(new HttpFoundationRequestHandler())
715715
->getForm();
@@ -1039,6 +1039,21 @@ public function testDisabledButtonIsNotSubmitted()
10391039
$this->assertFalse($submit->isSubmitted());
10401040
}
10411041

1042+
public function testFileUpload()
1043+
{
1044+
$reqHandler = new HttpFoundationRequestHandler();
1045+
$this->form->add($this->getBuilder('foo')->setRequestHandler($reqHandler)->getForm());
1046+
$this->form->add($this->getBuilder('bar')->setRequestHandler($reqHandler)->getForm());
1047+
1048+
$this->form->submit(array(
1049+
'foo' => 'Foo',
1050+
'bar' => new UploadedFile(__FILE__, 'upload.png', 'image/png', UPLOAD_ERR_OK),
1051+
));
1052+
1053+
$this->assertSame('Submitted data was expected to be text or number, file upload given.', $this->form->get('bar')->getTransformationFailure()->getMessage());
1054+
$this->assertNull($this->form->get('bar')->getData());
1055+
}
1056+
10421057
protected function createForm()
10431058
{
10441059
return $this->getBuilder()

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_1.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"parent": {
2929
"Symfony\\Component\\Form\\Extension\\Core\\Type\\FormType": [
3030
"action",
31+
"allow_file_upload",
3132
"attr",
3233
"auto_initialize",
3334
"block_name",

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_1.txt

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,16 @@ Symfony\Component\Form\Extension\Core\Type\ChoiceType (Block prefix: "choice")
88
choice_attr FormType FormType FormTypeCsrfExtension
99
choice_label -------------------- ------------------------- -----------------------
1010
choice_loader compound action csrf_field_name
11-
choice_name data_class attr csrf_message
12-
choice_translation_domain empty_data auto_initialize csrf_protection
13-
choice_value error_bubbling block_name csrf_token_id
14-
choices trim by_reference csrf_token_manager
15-
expanded data
16-
group_by disabled
17-
multiple help
18-
placeholder inherit_data
19-
preferred_choices label
11+
choice_name data_class allow_file_upload csrf_message
12+
choice_translation_domain empty_data attr csrf_protection
13+
choice_value error_bubbling auto_initialize csrf_token_id
14+
choices trim block_name csrf_token_manager
15+
expanded by_reference
16+
group_by data
17+
multiple disabled
18+
placeholder help
19+
preferred_choices inherit_data
20+
label
2021
label_attr
2122
label_format
2223
mapped

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_2.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
"options": {
55
"own": [
66
"action",
7+
"allow_file_upload",
78
"attr",
89
"auto_initialize",
910
"block_name",

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_2.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ Symfony\Component\Form\Extension\Core\Type\FormType (Block prefix: "form")
66
Options
77
-------------------------
88
action
9+
allow_file_upload
910
attr
1011
auto_initialize
1112
block_name

‎src/Symfony/Component/Security/Http/HttpUtils.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ public function __construct(UrlGeneratorInterface $urlGenerator = null, $urlMatc
5959
*/
6060
public function createRedirectResponse(Request $request, $path, $status = 302)
6161
{
62-
if (null !== $this->domainRegexp && preg_match('#^https?://[^/]++#i', $path, $host) && !preg_match(sprintf($this->domainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
62+
if (null !== $this->domainRegexp && preg_match('#^https?:[/\\\\]{2,}+[^/]++#i', $path, $host) && !preg_match(sprintf($this->domainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
6363
$path = '/';
6464
}
6565

‎src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,28 @@ public function testCreateRedirectResponseWithRequestsDomain()
5454
$this->assertTrue($response->isRedirect('http://localhost/blog'));
5555
}
5656

57-
public function testCreateRedirectResponseWithBadRequestsDomain()
57+
/**
58+
* @dataProvider badRequestDomainUrls
59+
*/
60+
public function testCreateRedirectResponseWithBadRequestsDomain($url)
5861
{
5962
$utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');
60-
$response = $utils->createRedirectResponse($this->getRequest(), 'http://pirate.net/foo');
63+
$response = $utils->createRedirectResponse($this->getRequest(), $url);
6164

6265
$this->assertTrue($response->isRedirect('http://localhost/'));
6366
}
6467

68+
public function badRequestDomainUrls()
69+
{
70+
return array(
71+
array('http://pirate.net/foo'),
72+
array('http:\\\\pirate.net/foo'),
73+
array('http:/\\pirate.net/foo'),
74+
array('http:\\/pirate.net/foo'),
75+
array('http://////pirate.net/foo'),
76+
);
77+
}
78+
6579
public function testCreateRedirectResponseWithProtocolRelativeTarget()
6680
{
6781
$utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');

0 commit comments

Comments
 (0)