Changeset 42968

Timestamp:

04/10/2018 11:18:04 PM (7 years ago)

Author:

iandunn

Message:

Dashboard: Strip more extraneous IP parts to prevent PHP warnings.

This iterates on earlier versions of the code, in order to handle more edge cases. An arbitrary string like or=\" will now be stripped, as well as reachability scopes like %eth0.

Props eamax, soulseekah, iandunn.
Fixes #41083.

Location:

trunk

Files:

• src/wp-admin/includes/class-wp-community-events.php (modified) (2 diffs)
• tests/phpunit/tests/admin/includesCommunityEvents.php (modified) (3 diffs)

trunk/src/wp-admin/includes/class-wp-community-events.php

@@ -234 +234 @@
      */
     public static function get_unsafe_client_ip() {
-        $client_ip = $netmask = false;
+        $client_ip = false;
         $ip_prefix = '';
 
@@ -280 +280 @@
         if ( $is_ipv6 ) {
             // IPv6 addresses will always be enclosed in [] if there's a port.
-            $ip_start = 1;
-            $ip_end   = (int) strpos( $client_ip, ']' ) - 1;
-            $netmask  = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
+            $left_bracket  = strpos( $client_ip, '[' );
+            $right_bracket = strpos( $client_ip, ']' );
+            $percent       = strpos( $client_ip, '%' );
+            $netmask       = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
 
             // Strip the port (and [] from IPv6 addresses), if they exist.
-            if ( $ip_end > 0 ) {
-                $client_ip = substr( $client_ip, $ip_start, $ip_end );
+            if ( false !== $left_bracket && false !== $right_bracket ) {
+                $client_ip = substr( $client_ip, $left_bracket + 1, $right_bracket - $left_bracket - 1 );
+            } elseif ( false !== $left_bracket || false !== $right_bracket ) {
+                // The IP has one bracket, but not both, so it's malformed.
+                return false;
+            }
+
+            // Strip the reachability scope.
+            if ( false !== $percent ) {
+                $client_ip = substr( $client_ip, 0, $percent );
+            }
+
+            // No invalid characters should be left.
+            if ( preg_match( '/[^0-9a-f:]/i', $client_ip ) ) {
+                return false;
             }
 

trunk/tests/phpunit/tests/admin/includesCommunityEvents.php

@@ -503 +503 @@
                 false,
             ),
+            // Invalid IP. Sometimes proxies add things like this, or other arbitrary strings.
+            array(
+                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001',
+                false,
+            ),
+            // Invalid IP. Sometimes proxies add things like this, or other arbitrary strings.
+            array(
+                'or=\"1000:0000:0000:0000:0000:0000:0000:0001',
+                false,
+            ),
+            // Invalid IP. Sometimes proxies add things like this, or other arbitrary strings.
+            array(
+                '1000:0000:0000:0000:0000:0000:0000:0001or=\"',
+                false,
+            ),
+            // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+            array(
+                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001]:400',
+                '1000::',
+            ),
+            // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+            array(
+                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001]',
+                '1000::',
+            ),
+            // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+            array(
+                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001]400',
+                '1000::',
+            ),
+            // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+            array(
+                '[1000:0000:0000:0000:0000:0000:0000:0001]:235\"or=',
+                '1000::',
+            ),
             // IPv4, no port
             array(
@@ -570 +605 @@
             // IPv6, port, compatibility mode
             array(
-                '[::ffff:10.15.20.25]:30000',
+                '[::FFFF:10.15.20.25]:30000',
                 '::ffff:10.15.20.0',
             ),
@@ -583 +618 @@
                 '::ffff:127.0.0.0',
             ),
+            // IPv6 with reachability scope
+            array(
+                'fe80::b059:65f4:e877:c40%16',
+                'fe80::',
+            ),
+            // IPv6 with reachability scope
+            array(
+                'FE80::B059:65F4:E877:C40%eth0',
+                'fe80::',
+            ),
         );
     }