Fix #77423 FILTER_VALIDATE_URL accepts URLs with invalid userinfo

  CVE-2020-7071

3 files changed, 369 insertions, 8 deletions

diff --git a/php-bug77423.patch b/php-bug77423.patch
new file mode 100644
index 0000000..668adac
--- /dev/null
+++ b/php-bug77423.patch
@@ -0,0 +1,209 @@
+From 7a90808f97cee0c12ae5c219eddc522721740d71 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69@gmx.de>
+Date: Wed, 13 May 2020 09:36:52 +0200
+Subject: [PATCH 1/2] Fix #77423: parse_url() will deliver a wrong host to user
+
+To avoid that `parse_url()` returns an erroneous host, which would be
+valid for `FILTER_VALIDATE_URL`, we make sure that only userinfo which
+is valid according to RFC 3986 is treated as such.
+
+For consistency with the existing url parsing code, we use ctype
+functions, although that is not necessarily correct.
+
+(cherry picked from commit 2d3d72412a6734e19a38ed10f385227a6238e4a6)
+(cherry picked from commit 31459f94f2780e748e15d5c2951ba20adbba2366)
+---
+ ext/standard/tests/strings/url_t.phpt         |  6 ++--
+ ext/standard/tests/url/bug77423.phpt          | 30 +++++++++++++++++++
+ .../tests/url/parse_url_basic_001.phpt        |  6 ++--
+ .../tests/url/parse_url_basic_003.phpt        |  2 +-
+ .../tests/url/parse_url_basic_005.phpt        |  2 +-
+ ext/standard/url.c                            | 21 +++++++++++++
+ 6 files changed, 57 insertions(+), 10 deletions(-)
+ create mode 100644 ext/standard/tests/url/bug77423.phpt
+
+diff --git a/ext/standard/tests/strings/url_t.phpt b/ext/standard/tests/strings/url_t.phpt
+index e172061ec2..80e164a08e 100644
+--- a/ext/standard/tests/strings/url_t.phpt
++++ b/ext/standard/tests/strings/url_t.phpt
+@@ -575,15 +575,13 @@ $sample_urls = array (
+   string(16) "some_page_ref123"
+ }
+ 
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
+   ["scheme"]=>
+   string(4) "http"
+   ["host"]=>
+-  string(11) "www.php.net"
++  string(26) "secret@hideout@www.php.net"
+   ["port"]=>
+   int(80)
+-  ["user"]=>
+-  string(14) "secret@hideout"
+   ["path"]=>
+   string(10) "/index.php"
+   ["query"]=>
+diff --git a/ext/standard/tests/url/bug77423.phpt b/ext/standard/tests/url/bug77423.phpt
+new file mode 100644
+index 0000000000..be03fe95e2
+--- /dev/null
++++ b/ext/standard/tests/url/bug77423.phpt
+@@ -0,0 +1,30 @@
++--TEST--
++Bug #77423 (parse_url() will deliver a wrong host to user)
++--FILE--
++<?php
++$urls = array(
++    "http://php.net\@aliyun.com/aaa.do",
++    "https://example.com\uFF03@bing.com",
++);
++foreach ($urls as $url) {
++    var_dump(filter_var($url, FILTER_VALIDATE_URL));
++    var_dump(parse_url($url));
++}
++?>
++--EXPECT--
++bool(false)
++array(3) {
++  ["scheme"]=>
++  string(4) "http"
++  ["host"]=>
++  string(19) "php.net\@aliyun.com"
++  ["path"]=>
++  string(7) "/aaa.do"
++}
++bool(false)
++array(2) {
++  ["scheme"]=>
++  string(5) "https"
++  ["host"]=>
++  string(26) "example.com\uFF03@bing.com"
++}
+diff --git a/ext/standard/tests/url/parse_url_basic_001.phpt b/ext/standard/tests/url/parse_url_basic_001.phpt
+index e468066a42..c9e9d32de0 100644
+--- a/ext/standard/tests/url/parse_url_basic_001.phpt
++++ b/ext/standard/tests/url/parse_url_basic_001.phpt
+@@ -507,15 +507,13 @@ echo "Done";
+   string(16) "some_page_ref123"
+ }
+ 
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
+   ["scheme"]=>
+   string(4) "http"
+   ["host"]=>
+-  string(11) "www.php.net"
++  string(26) "secret@hideout@www.php.net"
+   ["port"]=>
+   int(80)
+-  ["user"]=>
+-  string(14) "secret@hideout"
+   ["path"]=>
+   string(10) "/index.php"
+   ["query"]=>
+diff --git a/ext/standard/tests/url/parse_url_basic_003.phpt b/ext/standard/tests/url/parse_url_basic_003.phpt
+index 70dc4bb90b..431de27009 100644
+--- a/ext/standard/tests/url/parse_url_basic_003.phpt
++++ b/ext/standard/tests/url/parse_url_basic_003.phpt
+@@ -68,7 +68,7 @@ echo "Done";
+ --> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(11) "www.php.net"
+ --> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(11) "www.php.net"
+ --> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(11) "www.php.net"
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(11) "www.php.net"
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(26) "secret@hideout@www.php.net"
+ --> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(11) "www.php.net"
+ --> nntp://news.php.net   : string(12) "news.php.net"
+ --> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz   : string(11) "ftp.gnu.org"
+diff --git a/ext/standard/tests/url/parse_url_basic_005.phpt b/ext/standard/tests/url/parse_url_basic_005.phpt
+index b2ca06ff96..b2c1a1d6dd 100644
+--- a/ext/standard/tests/url/parse_url_basic_005.phpt
++++ b/ext/standard/tests/url/parse_url_basic_005.phpt
+@@ -68,7 +68,7 @@ echo "Done";
+ --> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(6) "secret"
+ --> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(0) ""
+ --> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(6) "secret"
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(14) "secret@hideout"
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : NULL
+ --> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123   : string(6) "secret"
+ --> nntp://news.php.net   : NULL
+ --> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz   : NULL
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+index 0278bd47e8..8da9da3d6a 100644
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -92,6 +92,22 @@ PHPAPI php_url *php_url_parse(char const *str)
+ 	return php_url_parse_ex(str, strlen(str));
+ }
+ 
++static int is_userinfo_valid(const char *str, size_t len)
++{
++	char *valid = "-._~!$&'()*+,;=:";
++	char *p = str;
++	while (p - str < len) {
++		if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
++			p++;
++		} else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
++			p += 3;
++		} else {
++			return 0;
++		}
++	}
++	return 1;
++}
++
+ /* {{{ php_url_parse
+  */
+ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
+@@ -230,13 +246,18 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
+ 			ret->pass = estrndup(pp, (p-pp));
+ 			php_replace_controlchars_ex(ret->pass, (p-pp));
+ 		} else {
++			if (!is_userinfo_valid(s, p-s)) {
++				goto check_port;
++			}
+ 			ret->user = estrndup(s, (p-s));
+ 			php_replace_controlchars_ex(ret->user, (p-s));
++
+ 		}
+ 
+ 		s = p + 1;
+ 	}
+ 
++check_port:
+ 	/* check for port */
+ 	if (s < ue && *s == '[' && *(e-1) == ']') {
+ 		/* Short circuit portscan,
+-- 
+2.29.2
+
+From d45b940106cb5a3bfc43f7a9616dde23f9ad1f43 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Mon, 4 Jan 2021 14:20:55 +0100
+Subject: [PATCH 2/2] NEWS
+
+(cherry picked from commit c784479182b92b9b3b96a7be42aa86a6c6d0b693)
+---
+ NEWS | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/NEWS b/NEWS
+index 7ca1c46721..43e3b8faf3 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,6 +1,12 @@
+ PHP                                                                        NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+ 
++Backported from 7.3.26
++
++- Standard:
++  . Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo).
++    (CVE-2020-7071) (cmb)
++
+ Backported from 7.2.34
+ 
+ - Core:
+-- 
+2.29.2
+
diff --git a/php-bug79699.patch b/php-bug79699.patch
new file mode 100644
index 0000000..5750b1d
--- /dev/null
+++ b/php-bug79699.patch
@@ -0,0 +1,142 @@
+From 21babd0059d6661573b44349d5ee5589677b9645 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Sun, 20 Sep 2020 18:08:55 -0700
+Subject: [PATCH] Do not decode cookie names anymore
+
+(cherry picked from commit 6559fe912661ca5ce5f0eeeb591d928451428ed0)
+---
+ main/php_variables.c      |  8 ++++++--
+ tests/basic/022.phpt      | 10 +++++++---
+ tests/basic/023.phpt      |  4 +++-
+ tests/basic/bug79699.phpt | 22 ++++++++++++++++++++++
+ 4 files changed, 38 insertions(+), 6 deletions(-)
+ create mode 100644 tests/basic/bug79699.phpt
+
+diff --git a/main/php_variables.c b/main/php_variables.c
+index 6da79bddc3..084b10fa56 100644
+--- a/main/php_variables.c
++++ b/main/php_variables.c
+@@ -472,7 +472,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
+ 			unsigned int new_val_len;
+ 
+ 			*val++ = '\0';
+-			php_url_decode(var, strlen(var));
++			if (arg != PARSE_COOKIE) {
++				php_url_decode(var, strlen(var));
++			}
+ 			val_len = php_url_decode(val, strlen(val));
+ 			val = estrndup(val, val_len);
+ 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
+@@ -483,7 +485,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
+ 			int val_len;
+ 			unsigned int new_val_len;
+ 
+-			php_url_decode(var, strlen(var));
++			if (arg != PARSE_COOKIE) {
++				php_url_decode(var, strlen(var));
++			}
+ 			val_len = 0;
+ 			val = estrndup("", val_len);
+ 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
+diff --git a/tests/basic/022.phpt b/tests/basic/022.phpt
+index 0ab70d4be7..bd1db13701 100644
+--- a/tests/basic/022.phpt
++++ b/tests/basic/022.phpt
+@@ -10,7 +10,7 @@ cookie1=val1  ; cookie2=val2%20; cookie3=val 3.; cookie 4= value 4 %3B; cookie1=
+ var_dump($_COOKIE);
+ ?>
+ --EXPECT--
+-array(10) {
++array(12) {
+   ["cookie1"]=>
+   string(6) "val1  "
+   ["cookie2"]=>
+@@ -19,11 +19,15 @@ array(10) {
+   string(6) "val 3."
+   ["cookie_4"]=>
+   string(10) " value 4 ;"
++  ["%20cookie1"]=>
++  string(6) "ignore"
++  ["+cookie1"]=>
++  string(6) "ignore"
+   ["cookie__5"]=>
+   string(7) "  value"
+-  ["cookie_6"]=>
++  ["cookie%206"]=>
+   string(3) "þæö"
+-  ["cookie_7"]=>
++  ["cookie+7"]=>
+   string(0) ""
+   ["$cookie_8"]=>
+   string(0) ""
+diff --git a/tests/basic/023.phpt b/tests/basic/023.phpt
+index ca5f1dcfbb..0e2e0ac669 100644
+--- a/tests/basic/023.phpt
++++ b/tests/basic/023.phpt
+@@ -10,9 +10,11 @@ c o o k i e=value; c o o k i e= v a l u e ;;c%20o+o k+i%20e=v;name="value","valu
+ var_dump($_COOKIE);
+ ?>
+ --EXPECT--
+-array(3) {
++array(4) {
+   ["c_o_o_k_i_e"]=>
+   string(5) "value"
++  ["c%20o+o_k+i%20e"]=>
++  string(1) "v"
+   ["name"]=>
+   string(24) ""value","value",UEhQIQ=="
+   ["UEhQIQ"]=>
+diff --git a/tests/basic/bug79699.phpt b/tests/basic/bug79699.phpt
+new file mode 100644
+index 0000000000..fc3d3fedb0
+--- /dev/null
++++ b/tests/basic/bug79699.phpt
+@@ -0,0 +1,22 @@
++--TEST--
++Cookies Security Bug
++--INI--
++max_input_vars=1000
++filter.default=unsafe_raw
++--COOKIE--
++__%48ost-evil=evil; __Host-evil=good; %66oo=baz;foo=bar
++--FILE--
++<?php
++var_dump($_COOKIE);
++?>
++--EXPECT--
++array(4) {
++  ["__%48ost-evil"]=>
++  string(4) "evil"
++  ["__Host-evil"]=>
++  string(4) "good"
++  ["%66oo"]=>
++  string(3) "baz"
++  ["foo"]=>
++  string(3) "bar"
++}
+From a9195bc602c7df0c569731bb1a7ddc72cdabfed1 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Tue, 29 Sep 2020 09:20:11 +0200
+Subject: [PATCH] NEWS
+
+---
+ NEWS | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/NEWS b/NEWS
+index cf34011622..7ca1c46721 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,6 +1,12 @@
+ PHP                                                                        NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+ 
++Backported from 7.2.34
++
++- Core:
++  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-`
++    cookies can be sent). (CVE-2020-7070) (Stas)
++
+ Backported from 7.2.33
+ 
+ - Core:
diff --git a/php.spec b/php.spec
index c42059f..2b47f06 100644
--- a/php.spec
+++ b/php.spec
@@ -69,7 +69,7 @@
 
 %else
 %ifarch x86_64
-%global oraclever 19.8
+%global oraclever 19.9
 %else
 %global oraclever 19.6
 %endif
@@ -94,12 +94,7 @@
 %global with_oci8     %{?_with_oci8:1}%{!?_with_oci8:0}
 
 %global with_imap      1
-# until firebird available in EPEL
-%if 0%{?rhel} == 8
-%global with_interbase 0
-%else
 %global with_interbase 1
-%endif
 %global with_mcrypt    1
 %global with_freetds   1
 %global with_tidy      1
@@ -151,7 +146,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: %{?scl_prefix}php
 Version: 5.6.40
-Release: 22%{?dist}
+Release: 24%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -249,6 +244,8 @@ Patch241: php-bug79465.patch
 Patch242: php-bug78875.patch
 Patch243: php-bug79797.patch
 Patch244: php-bug79877.patch
+Patch246: php-bug79699.patch
+Patch247: php-bug77423.patch
 
 # Fixes for tests (300+)
 # Factory is droped from system tzdata
@@ -283,6 +280,7 @@ BuildRequires: bzip2
 BuildRequires: perl
 BuildRequires: autoconf
 BuildRequires: automake
+BuildRequires: make
 BuildRequires: gcc
 BuildRequires: gcc-c++
 BuildRequires: libtool
@@ -471,6 +469,7 @@ Requires: %{?scl_prefix}php-cli%{?_isa} = %{version}-%{release}
 # always needed to build extension
 Requires: autoconf
 Requires: automake
+Requires: make
 Requires: gcc
 Requires: gcc-c++
 Requires: libtool
@@ -1020,6 +1019,8 @@ sed -e 's/php-devel/%{?scl_prefix}php-devel/' -i scripts/phpize.in
 %patch242 -p1 -b .bug78875
 %patch243 -p1 -b .bug79797
 %patch244 -p1 -b .bug79877
+%patch246 -p1 -b .bug79699
+%patch247 -p1 -b .bug77423
 
 # Fixes for tests
 %patch300 -p1 -b .datetests
@@ -1793,7 +1794,7 @@ cat << EOF
 
   WARNING : PHP 5.6 have reached its "End of Life" in
   January 2019. Even, if this package includes some of
-  the important security fix, backported from 7.2, the
+  the important security fix, backported from 7.3, the
   UPGRADE to a maintained version is very strongly RECOMMENDED.
 
 =====================================================================
@@ -1971,6 +1972,15 @@ EOF
 
 
 %changelog
+* Mon Jan  4 2021 Remi Collet <remi@remirepo.net> - 5.6.40-24
+- Fix #77423 FILTER_VALIDATE_URL accepts URLs with invalid userinfo
+  CVE-2020-7071
+
+* Tue Sep 29 2020 Remi Collet <remi@remirepo.net> - 5.6.40-23
+- Core:
+  Fix #79699 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
+  CVE-2020-7070
+
 * Tue Aug  4 2020 Remi Collet <remi@remirepo.net> - 5.6.40-22
 - Core:
   Fix #79877 getimagesize function silently truncates after a null byte