PSR-7 Integration Tests Failing #74
Comments
|
Related: php-http/psr7-integration-tests#49 |
This was referenced Apr 4, 2022
weierophinney
added a commit
to weierophinney/psr7-integration-tests
that referenced
this issue
Jul 28, 2022
Per an [issue created for Diactoros](laminas/laminas-diactoros#74) its [related pull request](laminas/laminas-diactoros#77), and the discussion to that pull request, this patch does the following: - It modifies `testPathWithMultipleSlashes()` to only validate that multiple slashes _not at the beginning_ of a path are retained intact. - It adds `testProperlyTrimsLeadingSlashesToPreventXSS()`, which validates that when multiple leading slashes are present in a path, they are reduced to a single slash. This approach is done to mitigate [ZF2015-05](https://framework.zend.com/security/advisory/ZF2015-05.html) which was also reported as [CVE-2015-3257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3257). While RFC 3986 allows for multiple slashes anywhere in the path, when security conflicts with a specification, security concerns win. Without the mitigation, an implementation is vulnerable to XSS and open redirects if only the path portion of a URI is used within HTML content (common!) or within headers (also common). Signed-off-by: Matthew Weier O'Phinney <matthew@weierophinney.net>
2 tasks
|
See #128 for a fix. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bug Report
The library is currently failing a
UriIntegrationTesthttps://github.com/php-http/psr7-integration-tests
Summary
Current behavior
Fails the tests
How to reproduce
Run PSR-7 Integration Tests against this library
Expected behavior
Pass the tests
The text was updated successfully, but these errors were encountered: