bug #34788 [SecurityBundle] Properly escape regex in AddSessionDomainConstraintPass (fancyweb)

chalasr · chalasr · commit ae6c5d3482cf · 2019-12-06T21:35:12.000+01:00
This PR was merged into the 3.4 branch. Discussion ---------- [SecurityBundle] Properly escape regex in AddSessionDomainConstraintPass | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | #34774 | License | MIT | Doc PR | - `%s` should be escaped, so it is dumped as `%%s` (it ends up being properly unescaped at load time, so the passed value to the service is the same). Commits ------- de03cee [SecurityBundle] Properly escape regex in AddSessionDomainConstraintPass
diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Compiler/AddSessionDomainConstraintPass.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Compiler/AddSessionDomainConstraintPass.php
@@ -31,7 +31,7 @@ public function process(ContainerBuilder $container)
         }
 
         $sessionOptions = $container->getParameter('session.storage.options');
-        $domainRegexp = empty($sessionOptions['cookie_domain']) ? '%s' : sprintf('(?:%%s|(?:.+\.)?%s)', preg_quote(trim($sessionOptions['cookie_domain'], '.')));
+        $domainRegexp = empty($sessionOptions['cookie_domain']) ? '%%s' : sprintf('(?:%%%%s|(?:.+\.)?%s)', preg_quote(trim($sessionOptions['cookie_domain'], '.')));
         $domainRegexp = (empty($sessionOptions['cookie_secure']) ? 'https?://' : 'https://').$domainRegexp;
 
         $container->findDefinition('security.http_utils')->addArgument(sprintf('{^%s$}i', $domainRegexp));

Original file line number	Diff line number	Diff line change
`@@ -31,7 +31,7 @@ public function process(ContainerBuilder $container)`
`31`	`31`	`}`
`32`	`32`
`33`	`33`	`$sessionOptions = $container->getParameter('session.storage.options');`
`34`		`- $domainRegexp = empty($sessionOptions['cookie_domain']) ? '%s' : sprintf('(?:%%s\|(?:.+\.)?%s)', preg_quote(trim($sessionOptions['cookie_domain'], '.')));`
	`34`	`+ $domainRegexp = empty($sessionOptions['cookie_domain']) ? '%%s' : sprintf('(?:%%%%s\|(?:.+\.)?%s)', preg_quote(trim($sessionOptions['cookie_domain'], '.')));`
`35`	`35`	`$domainRegexp = (empty($sessionOptions['cookie_secure']) ? 'https?://' : 'https://').$domainRegexp;`
`36`	`36`
`37`	`37`	`$container->findDefinition('security.http_utils')->addArgument(sprintf('{^%s$}i', $domainRegexp));`