Revision: 2183
Author: olavmrk
Date: Tue Feb 16 04:21:51 2010
Log: Add the 'D'-modifier to all regex'es that match the full string.
By default '$' matches end of string, or newline at end of string,
which made it possible to add a trailing newline to some strings that
shouldn't have it.
As far as I can tell, none of the errors presented a security problem.
http://code.google.com/p/simplesamlphp/source/detail?r=2183
Modified:
/trunk/lib/SimpleSAML/Configuration.php
/trunk/lib/SimpleSAML/Utilities.php
/trunk/lib/SimpleSAML/XHTML/Template.php
/trunk/modules/casserver/www/serviceValidate.php
/trunk/modules/casserver/www/validate.php
/trunk/modules/logpeek/www/index.php
/trunk/www/admin/test.php
/trunk/www/auth/login-feide.php
/trunk/www/module.php
=======================================
--- /trunk/lib/SimpleSAML/Configuration.php Fri Jan 15 02:10:50 2010
+++ /trunk/lib/SimpleSAML/Configuration.php Tue Feb 16 04:21:51 2010
@@ -335,7 +335,7 @@
public function getBaseURL() {
- if (preg_match('/^\*(.*)$/',
$this->getString('baseurlpath', 'simplesaml/'), $matches)) {
+ if (preg_match('/^\*(.*)$/D',
$this->getString('baseurlpath', 'simplesaml/'), $matches)) {
return SimpleSAML_Utilities::getFirstPathElement(false)
. $matches[1];
}
=======================================
--- /trunk/lib/SimpleSAML/Utilities.php Fri Feb 12 06:46:49 2010
+++ /trunk/lib/SimpleSAML/Utilities.php Tue Feb 16 04:21:51 2010
@@ -472,7 +472,7 @@
assert('is_null($timestamp) || is_int($timestamp)');
/* Parse the duration. We use a very strict pattern. */
- $durationRegEx
= '#^(-?)P(?:(?:(?:(\\d+)Y)?(?:(\\d+)M)?(?:(\\d+)D)?(?:T(?:(\\d+)H)?(?:(\\d+)M)?(?:(\\d+)S)?)?)|
(?:(\\d+)W))$#';
+ $durationRegEx
= '#^(-?)P(?:(?:(?:(\\d+)Y)?(?:(\\d+)M)?(?:(\\d+)D)?(?:T(?:(\\d+)H)?(?:(\\d+)M)?(?:(\\d+)S)?)?)|
(?:(\\d+)W))$#D';
if (!preg_match($durationRegEx, $duration, $matches)) {
throw new Exception('Invalid ISO 8601 duration: ' .
$duration);
}
=======================================
--- /trunk/lib/SimpleSAML/XHTML/Template.php Thu Jan 28 01:29:55 2010
+++ /trunk/lib/SimpleSAML/XHTML/Template.php Tue Feb 16 04:21:51 2010
@@ -252,7 +252,7 @@
}
/* Check whether we should use the default dictionary or a dictionary
specified in the tag. */
- if(substr($tag, 0, 1) === '{' &&
preg_match('/^{((?:\w+:)?\w+?):(.*)}$/', $tag, $matches)) {
+ if(substr($tag, 0, 1) === '{' &&
preg_match('/^{((?:\w+:)?\w+?):(.*)}$/D', $tag, $matches)) {
$dictionary = $matches[1];
$tag = $matches[2];
} else {
=======================================
--- /trunk/modules/casserver/www/serviceValidate.php Sat Apr 25 06:53:30
2009
+++ /trunk/modules/casserver/www/serviceValidate.php Tue Feb 16 04:21:51
2010
@@ -91,7 +91,7 @@
function retrieveTicket($ticket, $path) {
- if (!preg_match('/^_?[a-zA-Z0-9]+$/', $ticket)) throw new
Exception('Invalid characters in ticket');
+ if (!preg_match('/^_?[a-zA-Z0-9]+$/D', $ticket)) throw new
Exception('Invalid characters in ticket');
if (!is_dir($path))
throw new Exception('Directory for CAS Server ticket storage [' .
$path . '] does not exists. ');
=======================================
--- /trunk/modules/casserver/www/validate.php Wed Feb 25 23:19:00 2009
+++ /trunk/modules/casserver/www/validate.php Tue Feb 16 04:21:51 2010
@@ -72,7 +72,7 @@
function retrieveTicket($ticket, $path) {
- if (!preg_match('/^_?[a-zA-Z0-9]+$/', $ticket)) throw new
Exception('Invalid characters in ticket');
+ if (!preg_match('/^_?[a-zA-Z0-9]+$/D', $ticket)) throw new
Exception('Invalid characters in ticket');
if (!is_dir($path))
throw new Exception('Directory for CAS Server ticket storage [' .
$path . '] does not exists. ');
=======================================
--- /trunk/modules/logpeek/www/index.php Fri Apr 24 00:32:10 2009
+++ /trunk/modules/logpeek/www/index.php Tue Feb 16 04:21:51 2010
@@ -1,7 +1,7 @@
<?php
function logFilter($objFile, $tag, $cut){
- if (!preg_match('/^[a-f0-9]{10}$/', $tag)) throw new Exception('Invalid
search tag');
+ if (!preg_match('/^[a-f0-9]{10}$/D', $tag)) throw new Exception('Invalid
search tag');
$i = 0;
$results = array();
=======================================
--- /trunk/www/admin/test.php Wed Oct 7 02:12:09 2009
+++ /trunk/www/admin/test.php Tue Feb 16 04:21:51 2010
@@ -67,7 +67,7 @@
$attr_test = array();
foreach ($_GET as $k => $v) {
- if(preg_match('/^attr_test(?:_\d+)?$/', $k)) {
+ if(preg_match('/^attr_test(?:_\d+)?$/D', $k)) {
$pos = strpos($v, ':');
if($pos === FALSE) {
error('Invalid attribute test: $v');
=======================================
--- /trunk/www/auth/login-feide.php Wed Feb 10 03:32:00 2010
+++ /trunk/www/auth/login-feide.php Tue Feb 16 04:21:51 2010
@@ -121,7 +121,7 @@
/*
* Checking username parameter for illegal characters.
*/
- if (!preg_match('/^[a-z0-9._]+(@[a-z0-9._]+)?$/',
$requestedUser) )
+ if (!preg_match('/^[a-z0-9._]+(@[a-z0-9._]+)?$/D',
$requestedUser) )
throw new Exception('Illegal characters in (or empty)
username.');
/*
@@ -143,7 +143,7 @@
$requestedOrg = strtolower($_REQUEST['org']);
}
- if (!preg_match('/^[a-z0-9.]*$/', $requestedOrg) )
+ if (!preg_match('/^[a-z0-9.]*$/D', $requestedOrg) )
throw new Exception('Illegal characters in
organization.');
if (!array_key_exists($requestedOrg, $ldaporgconfig))
@@ -159,7 +159,7 @@
$password = $_REQUEST['password'];
- if (!preg_match('/^[a-zA-Z0-9.]+$/', $password) )
+ if (!preg_match('/^[a-zA-Z0-9.]+$/D', $password) )
throw new Exception('Illegal characters in password.');
/*
=======================================
--- /trunk/www/module.php Fri Dec 4 00:07:03 2009
+++ /trunk/www/module.php Tue Feb 16 04:21:51 2010
@@ -129,7 +129,7 @@
throw new SimpleSAML_Error_NotFound('The URL wasn\'t found in the
module.');
}
- if (preg_match('#\.php$#', $path)) {
+ if (preg_match('#\.php$#D', $path)) {
/* PHP file - attempt to run it. */
$_SERVER['SCRIPT_NAME'] .= '/' . $module . '/' . $url;
require($path);
@@ -140,7 +140,7 @@
/* Find MIME type for file, based on extension. */
$contentType = NULL;
- if (preg_match('#\.([^/]+)$#', $path, $type)) {
+ if (preg_match('#\.([^/]+)$#D', $path, $type)) {
$type = strtolower($type[1]);
if (array_key_exists($type, $mimeTypes)) {
$contentType = $mimeTypes[$type];
--
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en.
