Last modified: 2014-03-25 14:09:30 UTC
Security checks added in r67684 disable redirect-following for HTTP requests when using the CURL backend if the CURL version is an older version known to improperly validate the redirects. Since we have code to follow HTTP redirects in PhpHttpRequest already, it ought to be simple to just bump some of the logic up a level and run that above the abstraction layer, using it for CurlHttpRequest as well rather than using the CURLOPT_FOLLOWLOCATION option. This would allow our own protocol security checks to be applied consistently at all times, and could also allow for a callback, eg for the caller to apply their own domain checks at each stage.
Vulnerability report: http://cve.mitre.org/cgi-bin/cvename.cgi?name=0 Vulnerability in curl was fixed in 7.19.3, released 2009-01-19 (http://curl.haxx.se/changes.html) Minimum version of PHP we support is 5.2.3, released 2007-05-31 (http://www.php.net/ChangeLog-5.php#5.2.3) I'll try to get this fixed in time for release.
unassigning myself so I don't practgice cookie-licking
for 1.18 tarball we should either fix this or add something to the release notes.
Reading over brion's comments more carefully (and making a stab at implementation), I see that this is more significant than a release notes thing. The following bit definitely won't be implemented in time for 1.18. > This would allow our own protocol security checks to be applied consistently at > all times, and could also allow for a callback, eg for the caller to apply > their own domain checks at each stage. And the vulnerability report in comment #1 was fixed in Tim's original implementation (duh!).
(mass change) * 1.18.0 and 1.19.0 have been released already. * Moving open bugs targeted for 1.18.0 or 1.19.0 to Mysterious future. * Please re-target them to 1.19.x or 1.20.0 if needed.
