[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Checks for validity of requested URL's extension.
   4   *
   5   * This program is free software; you can redistribute it and/or modify
   6   * it under the terms of the GNU General Public License as published by
   7   * the Free Software Foundation; either version 2 of the License, or
   8   * (at your option) any later version.
   9   *
  10   * This program is distributed in the hope that it will be useful,
  11   * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13   * GNU General Public License for more details.
  14   *
  15   * You should have received a copy of the GNU General Public License along
  16   * with this program; if not, write to the Free Software Foundation, Inc.,
  17   * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18   * http://www.gnu.org/copyleft/gpl.html
  19   *
  20   * @file
  21   */
  22  
  23  /**
  24   * Internet Explorer derives a cache filename from a URL, and then in certain
  25   * circumstances, uses the extension of the resulting file to determine the
  26   * content type of the data, ignoring the Content-Type header.
  27   *
  28   * This can be a problem, especially when non-HTML content is sent by MediaWiki,
  29   * and Internet Explorer interprets it as HTML, exposing an XSS vulnerability.
  30   *
  31   * Usually the script filename (e.g. api.php) is present in the URL, and this
  32   * makes Internet Explorer think the extension is a harmless script extension.
  33   * But Internet Explorer 6 and earlier allows the script extension to be
  34   * obscured by encoding the dot as "%2E".
  35   *
  36   * This class contains functions which help in detecting and dealing with this
  37   * situation.
  38   *
  39   * Checking the URL for a bad extension is somewhat complicated due to the fact
  40   * that CGI doesn't provide a standard method to determine the URL. Instead it
  41   * is necessary to pass a subset of $_SERVER variables, which we then attempt
  42   * to use to guess parts of the URL.
  43   */
  44  class IEUrlExtension {
  45      /**
  46       * Check a subset of $_SERVER (or the whole of $_SERVER if you like)
  47       * to see if it indicates that the request was sent with a bad file
  48       * extension. Returns true if the request should be denied or modified,
  49       * false otherwise. The relevant $_SERVER elements are:
  50       *
  51       *   - SERVER_SOFTWARE
  52       *   - REQUEST_URI
  53       *   - QUERY_STRING
  54       *   - PATH_INFO
  55       *
  56       * If the a variable is unset in $_SERVER, it should be unset in $vars.
  57       *
  58       * @param array $vars A subset of $_SERVER.
  59       * @param array $extWhitelist Extensions which are allowed, assumed harmless.
  60       * @return bool
  61       */
  62  	public static function areServerVarsBad( $vars, $extWhitelist = array() ) {
  63          // Check QUERY_STRING or REQUEST_URI
  64          if ( isset( $vars['SERVER_SOFTWARE'] )
  65              && isset( $vars['REQUEST_URI'] )
  66              && self::haveUndecodedRequestUri( $vars['SERVER_SOFTWARE'] ) )
  67          {
  68              $urlPart = $vars['REQUEST_URI'];
  69          } elseif ( isset( $vars['QUERY_STRING'] ) ) {
  70              $urlPart = $vars['QUERY_STRING'];
  71          } else {
  72              $urlPart = '';
  73          }
  74  
  75          if ( self::isUrlExtensionBad( $urlPart, $extWhitelist ) ) {
  76              return true;
  77          }
  78  
  79          // Some servers have PATH_INFO but not REQUEST_URI, so we check both
  80          // to be on the safe side.
  81          if ( isset( $vars['PATH_INFO'] )
  82              && self::isUrlExtensionBad( $vars['PATH_INFO'], $extWhitelist ) )
  83          {
  84              return true;
  85          }
  86  
  87          // All checks passed
  88          return false;
  89      }
  90  
  91      /**
  92       * Given a right-hand portion of a URL, determine whether IE would detect
  93       * a potentially harmful file extension.
  94       *
  95       * @param string $urlPart The right-hand portion of a URL
  96       * @param array $extWhitelist An array of file extensions which may occur in this
  97       *    URL, and which should be allowed.
  98       * @return bool
  99       */
 100  	public static function isUrlExtensionBad( $urlPart, $extWhitelist = array() ) {
 101          if ( strval( $urlPart ) === '' ) {
 102              return false;
 103          }
 104  
 105          $extension = self::findIE6Extension( $urlPart );
 106          if ( strval( $extension ) === '' ) {
 107              // No extension or empty extension
 108              return false;
 109          }
 110  
 111          if ( in_array( $extension, array( 'php', 'php5' ) ) ) {
 112              // Script extension, OK
 113              return false;
 114          }
 115          if ( in_array( $extension, $extWhitelist ) ) {
 116              // Whitelisted extension
 117              return false;
 118          }
 119  
 120          if ( !preg_match( '/^[a-zA-Z0-9_-]+$/', $extension ) ) {
 121              // Non-alphanumeric extension, unlikely to be registered.
 122              //
 123              // The regex above is known to match all registered file extensions
 124              // in a default Windows XP installation. It's important to allow
 125              // extensions with ampersands and percent signs, since that reduces
 126              // the number of false positives substantially.
 127              return false;
 128          }
 129  
 130          // Possibly bad extension
 131          return true;
 132      }
 133  
 134      /**
 135       * Returns a variant of $url which will pass isUrlExtensionBad() but has the
 136       * same GET parameters, or false if it can't figure one out.
 137       * @param $url
 138       * @param $extWhitelist array
 139       * @return bool|string
 140       */
 141  	public static function fixUrlForIE6( $url, $extWhitelist = array() ) {
 142          $questionPos = strpos( $url, '?' );
 143          if ( $questionPos === false ) {
 144              $beforeQuery = $url . '?';
 145              $query = '';
 146          } elseif ( $questionPos === strlen( $url ) - 1 ) {
 147              $beforeQuery = $url;
 148              $query = '';
 149          } else {
 150              $beforeQuery = substr( $url, 0, $questionPos + 1 );
 151              $query = substr( $url, $questionPos + 1 );
 152          }
 153  
 154          // Multiple question marks cause problems. Encode the second and
 155          // subsequent question mark.
 156          $query = str_replace( '?', '%3E', $query );
 157          // Append an invalid path character so that IE6 won't see the end of the
 158          // query string as an extension
 159          $query .= '&*';
 160          // Put the URL back together
 161          $url = $beforeQuery . $query;
 162          if ( self::isUrlExtensionBad( $url, $extWhitelist ) ) {
 163              // Avoid a redirect loop
 164              return false;
 165          }
 166          return $url;
 167      }
 168  
 169      /**
 170       * Determine what extension IE6 will infer from a certain query string.
 171       * If the URL has an extension before the question mark, IE6 will use
 172       * that and ignore the query string, but per the comment at
 173       * isPathInfoBad() we don't have a reliable way to determine the URL,
 174       * so isPathInfoBad() just passes in the query string for $url.
 175       * All entry points have safe extensions (php, php5) anyway, so
 176       * checking the query string is possibly overly paranoid but never
 177       * insecure.
 178       *
 179       * The criteria for finding an extension are as follows:
 180       * - a possible extension is a dot followed by one or more characters not
 181       *   in <>\"/:|?.#
 182       * - if we find a possible extension followed by the end of the string or
 183       *   a #, that's our extension
 184       * - if we find a possible extension followed by a ?, that's our extension
 185       *    - UNLESS it's exe, dll or cgi, in which case we ignore it and continue
 186       *      searching for another possible extension
 187       * - if we find a possible extension followed by a dot or another illegal
 188       *   character, we ignore it and continue searching
 189       *
 190       * @param string $url URL
 191       * @return mixed Detected extension (string), or false if none found
 192       */
 193  	public static function findIE6Extension( $url ) {
 194          $pos = 0;
 195          $hashPos = strpos( $url, '#' );
 196          if ( $hashPos !== false ) {
 197              $urlLength = $hashPos;
 198          } else {
 199              $urlLength = strlen( $url );
 200          }
 201          $remainingLength = $urlLength;
 202          while ( $remainingLength > 0 ) {
 203              // Skip ahead to the next dot
 204              $pos += strcspn( $url, '.', $pos, $remainingLength );
 205              if ( $pos >= $urlLength ) {
 206                  // End of string, we're done
 207                  return false;
 208              }
 209  
 210              // We found a dot. Skip past it
 211              $pos++;
 212              $remainingLength = $urlLength - $pos;
 213  
 214              // Check for illegal characters in our prospective extension,
 215              // or for another dot
 216              $nextPos = $pos + strcspn( $url, "<>\\\"/:|?*.", $pos, $remainingLength );
 217              if ( $nextPos >= $urlLength ) {
 218                  // No illegal character or next dot
 219                  // We have our extension
 220                  return substr( $url, $pos, $urlLength - $pos );
 221              }
 222              if ( $url[$nextPos] === '?' ) {
 223                  // We've found a legal extension followed by a question mark
 224                  // If the extension is NOT exe, dll or cgi, return it
 225                  $extension = substr( $url, $pos, $nextPos - $pos );
 226                  if ( strcasecmp( $extension, 'exe' ) && strcasecmp( $extension, 'dll' ) &&
 227                      strcasecmp( $extension, 'cgi' ) )
 228                  {
 229                      return $extension;
 230                  }
 231                  // Else continue looking
 232              }
 233              // We found an illegal character or another dot
 234              // Skip to that character and continue the loop
 235              $pos = $nextPos;
 236              $remainingLength = $urlLength - $pos;
 237          }
 238          return false;
 239      }
 240  
 241      /**
 242       * When passed the value of $_SERVER['SERVER_SOFTWARE'], this function
 243       * returns true if that server is known to have a REQUEST_URI variable
 244       * with %2E not decoded to ".". On such a server, it is possible to detect
 245       * whether the script filename has been obscured.
 246       *
 247       * The function returns false if the server is not known to have this
 248       * behavior. Microsoft IIS in particular is known to decode escaped script
 249       * filenames.
 250       *
 251       * SERVER_SOFTWARE typically contains either a plain string such as "Zeus",
 252       * or a specification in the style of a User-Agent header, such as
 253       * "Apache/1.3.34 (Unix) mod_ssl/2.8.25 OpenSSL/0.9.8a PHP/4.4.2"
 254       *
 255       * @param $serverSoftware
 256       * @return bool
 257       *
 258       */
 259  	public static function haveUndecodedRequestUri( $serverSoftware ) {
 260          static $whitelist = array(
 261              'Apache',
 262              'Zeus',
 263              'LiteSpeed' );
 264          if ( preg_match( '/^(.*?)($|\/| )/', $serverSoftware, $m ) ) {
 265              return in_array( $m[1], $whitelist );
 266          } else {
 267              return false;
 268          }
 269      }
 270  
 271  }