Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3aaa5ab

Browse files
nicolas-grekasnicolas-grekas
committed
Merge branch '2.8' into 3.4
* 2.8: [Security\Http] detect bad redirect targets using backslashes [Form] Filter file uploads out of regular form types Fix CI minor #28258 [travis] fix composer.lock invalidation for deps=low (nicolas-grekas) [travis] fix composer.lock invalidation for PRs patching several components [travis] fix composer.lock invalidation for deps=low minor #28199 [travis][appveyor] use symfony/flex to accelerate builds (nicolas-grekas) [travis] ignore ordering when validating composer.lock files for deps=low minor #28146 [travis] cache composer.lock files for deps=low (nicolas-grekas) fix ci [travis] fix requiring mongodb/mongodb before composer up minor #28114 [travis] merge "same Symfony version" jobs in one (nicolas-grekas) [2.7] Make CI green updated VERSION for 2.7.49 updated CHANGELOG for 2.7.49 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer [HttpFoundation] Remove support for legacy and risky HTTP headers updated VERSION for 2.7.48 update CONTRIBUTORS for 2.7.48 updated CHANGELOG for 2.7.48
2 parents 922e13c + 410ed83 commit 3aaa5ab

File tree

10 files changed

+58
-14
lines changed

10 files changed

+58
-14
lines changed

‎src/Symfony/Component/Form/Extension/Core/Type/FileType.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ public function configureOptions(OptionsResolver $resolver)
105105
'data_class' => $dataClass,
106106
'empty_data' => $emptyData,
107107
'multiple' => false,
108+
'allow_file_upload' => true,
108109
));
109110
}
110111

‎src/Symfony/Component/Form/Extension/Core/Type/FormType.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,7 @@ public function configureOptions(OptionsResolver $resolver)
178178
'attr' => array(),
179179
'post_max_size_message' => 'The uploaded file was too large. Please try to upload a smaller file.',
180180
'upload_max_size_message' => $uploadMaxSizeMessage, // internal
181+
'allow_file_upload' => false,
181182
));
182183

183184
$resolver->setAllowedTypes('label_attr', 'array');

‎src/Symfony/Component/Form/Form.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -532,6 +532,11 @@ public function submit($submittedData, $clearMissing = true)
532532
$submittedData = null;
533533
} elseif (is_scalar($submittedData)) {
534534
$submittedData = (string) $submittedData;
535+
} elseif ($this->config->getOption('allow_file_upload')) {
536+
// no-op
537+
} elseif ($this->config->getRequestHandler()->isFileUpload($submittedData)) {
538+
$submittedData = null;
539+
$this->transformationFailure = new TransformationFailedException('Submitted data was expected to be text or number, file upload given.');
535540
}
536541

537542
$dispatcher = $this->config->getEventDispatcher();
@@ -541,6 +546,10 @@ public function submit($submittedData, $clearMissing = true)
541546
$viewData = null;
542547

543548
try {
549+
if (null !== $this->transformationFailure) {
550+
throw $this->transformationFailure;
551+
}
552+
544553
// Hook to change content of the data submitted by the browser
545554
if ($dispatcher->hasListeners(FormEvents::PRE_SUBMIT)) {
546555
$event = new FormEvent($this, $submittedData);

‎src/Symfony/Component/Form/Tests/CompoundFormTest.php

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -707,7 +707,7 @@ public function testSubmitPostOrPutRequestWithSingleChildForm($method)
707707
'REQUEST_METHOD' => $method,
708708
));
709709

710-
$form = $this->getBuilder('image')
710+
$form = $this->getBuilder('image', null, null, array('allow_file_upload' => true))
711711
->setMethod($method)
712712
->setRequestHandler(new HttpFoundationRequestHandler())
713713
->getForm();
@@ -1036,6 +1036,21 @@ public function testDisabledButtonIsNotSubmitted()
10361036
$this->assertFalse($submit->isSubmitted());
10371037
}
10381038

1039+
public function testFileUpload()
1040+
{
1041+
$reqHandler = new HttpFoundationRequestHandler();
1042+
$this->form->add($this->getBuilder('foo')->setRequestHandler($reqHandler)->getForm());
1043+
$this->form->add($this->getBuilder('bar')->setRequestHandler($reqHandler)->getForm());
1044+
1045+
$this->form->submit(array(
1046+
'foo' => 'Foo',
1047+
'bar' => new UploadedFile(__FILE__, 'upload.png', 'image/png', 123, UPLOAD_ERR_OK),
1048+
));
1049+
1050+
$this->assertSame('Submitted data was expected to be text or number, file upload given.', $this->form->get('bar')->getTransformationFailure()->getMessage());
1051+
$this->assertNull($this->form->get('bar')->getData());
1052+
}
1053+
10391054
protected function createForm()
10401055
{
10411056
return $this->getBuilder()

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_1.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
"parent": {
3030
"Symfony\\Component\\Form\\Extension\\Core\\Type\\FormType": [
3131
"action",
32+
"allow_file_upload",
3233
"attr",
3334
"auto_initialize",
3435
"block_name",

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_1.txt

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,17 @@ Symfony\Component\Form\Extension\Core\Type\ChoiceType (Block prefix: "choice")
88
choice_attr FormType FormType FormTypeCsrfExtension
99
choice_label -------------------- ------------------------- -----------------------
1010
choice_loader compound action csrf_field_name
11-
choice_name data_class attr csrf_message
12-
choice_translation_domain empty_data auto_initialize csrf_protection
13-
choice_value error_bubbling block_name csrf_token_id
14-
choices trim by_reference csrf_token_manager
15-
choices_as_values data
16-
expanded disabled
17-
group_by inherit_data
18-
multiple label
19-
placeholder label_attr
20-
preferred_choices label_format
11+
choice_name data_class allow_file_upload csrf_message
12+
choice_translation_domain empty_data attr csrf_protection
13+
choice_value error_bubbling auto_initialize csrf_token_id
14+
choices trim block_name csrf_token_manager
15+
choices_as_values by_reference
16+
expanded data
17+
group_by disabled
18+
multiple inherit_data
19+
placeholder label
20+
preferred_choices label_attr
21+
label_format
2122
mapped
2223
method
2324
post_max_size_message

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_2.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
"options": {
55
"own": [
66
"action",
7+
"allow_file_upload",
78
"attr",
89
"auto_initialize",
910
"block_name",

‎src/Symfony/Component/Form/Tests/Fixtures/Descriptor/resolved_form_type_2.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ Symfony\Component\Form\Extension\Core\Type\FormType (Block prefix: "form")
66
Options
77
-------------------------
88
action
9+
allow_file_upload
910
attr
1011
auto_initialize
1112
block_name

‎src/Symfony/Component/Security/Http/HttpUtils.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ public function __construct(UrlGeneratorInterface $urlGenerator = null, $urlMatc
5959
*/
6060
public function createRedirectResponse(Request $request, $path, $status = 302)
6161
{
62-
if (null !== $this->domainRegexp && preg_match('#^https?://[^/]++#i', $path, $host) && !preg_match(sprintf($this->domainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
62+
if (null !== $this->domainRegexp && preg_match('#^https?:[/\\\\]{2,}+[^/]++#i', $path, $host) && !preg_match(sprintf($this->domainRegexp, preg_quote($request->getHttpHost())), $host[0])) {
6363
$path = '/';
6464
}
6565

‎src/Symfony/Component/Security/Http/Tests/HttpUtilsTest.php

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,28 @@ public function testCreateRedirectResponseWithRequestsDomain()
5454
$this->assertTrue($response->isRedirect('http://localhost/blog'));
5555
}
5656

57-
public function testCreateRedirectResponseWithBadRequestsDomain()
57+
/**
58+
* @dataProvider badRequestDomainUrls
59+
*/
60+
public function testCreateRedirectResponseWithBadRequestsDomain($url)
5861
{
5962
$utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');
60-
$response = $utils->createRedirectResponse($this->getRequest(), 'http://pirate.net/foo');
63+
$response = $utils->createRedirectResponse($this->getRequest(), $url);
6164

6265
$this->assertTrue($response->isRedirect('http://localhost/'));
6366
}
6467

68+
public function badRequestDomainUrls()
69+
{
70+
return array(
71+
array('http://pirate.net/foo'),
72+
array('http:\\\\pirate.net/foo'),
73+
array('http:/\\pirate.net/foo'),
74+
array('http:\\/pirate.net/foo'),
75+
array('http://////pirate.net/foo'),
76+
);
77+
}
78+
6579
public function testCreateRedirectResponseWithProtocolRelativeTarget()
6680
{
6781
$utils = new HttpUtils($this->getUrlGenerator(), null, '#^https?://%s$#i');

0 commit comments

Comments
 (0)