Description:
------------
url like these
- http://example.com:80#@google.com/
- http://example.com:80?@google.com/
parse_url return wrong host.
https://tools.ietf.org/html/rfc3986#section-3.2
The authority component is preceded by a double slash ("//") and is
terminated by the next slash ("/"), question mark ("?"), or number
sign ("#") character, or by the end of the URI.
This problem has been fixed in 7.1.
https://github.com/php/php-src/pull/1607
But, this issue should be recognized as security issue.
example:
- bypass authentication protocol (verify hostname of callback url by parse_url)
- open redirector (verify hostname by parse_url)
- server-side request forgery (verify hostname by parse_url and get_content)
Test script:
---------------
php > echo parse_url("http://example.com:80#@google.com/")["host"];
google.com
php > echo parse_url("http://example.com:80?@google.com/")["host"];
google.com
php > echo file_get_contents("http://example.com:80#@google.com");
... contents of example.com ...
Expected result:
----------------
parse_url("http://example.com:80#@google.com/")["host"];
example.com or parse error.
