Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118111
MIME-Version: 1.0
References: <CAOfKkdTjPiZHnSHuag_+fmFK-1Advh2-vfDgbJBXEmK=72NB0g@mail.gmail.com>
 <CABdc3WryiOY=3cMTdi+gVxbE+twi8ixJGtG9Gfa+4RfJQT5DhQ@mail.gmail.com>
 <CAOfKkdRv7OgCDt4Str3sP3Nsfqc3+F1r3OS80s+DDFFnidxy0A@mail.gmail.com> <4511aee0-b5a0-6310-270f-38ae5cfd8a06@gmail.com>
In-Reply-To: <4511aee0-b5a0-6310-270f-38ae5cfd8a06@gmail.com>
Date: Mon, 27 Jun 2022 17:32:03 -0400
Message-ID: <CAOfKkdRDw+qDV==n-sUXEK4WBDo-LqCzAwnavaaOVpKctn22cg@mail.gmail.com>
To: Rowan Tommins <rowan.collins@gmail.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary="0000000000005863f505e274a739"
Subject: Re: [PHP-DEV] [RFC] [Under Discussion] New Curl URL API
From: pierrick@adoy.net (Pierrick Charron)

--0000000000005863f505e274a739
Content-Type: text/plain; charset="UTF-8"

Hi Rowan


> If I've got a URL, which is already a string, what code would I write to
> "do some checks" on it, outside of a unit test?
>

That's just an example with an old version of PHP, but let's say you have
some code that makes requests but only to a specific list of servers, so
you want to analyze the URL and check if the host is in a whitelist. If the
provided URL is "http://127.0.0.1:11211#@google.com:80/" and that you used
PHP <= 7.0.13 your parse_url function would tell you that the domain you're
trying to request is google.com so everything is fine, but in fact when the
call to curl is made, curl would call 127.0.0.1. This one was fixed but the
problem could still occur if the parser is not the same as the one used in
the requester.


>
> If I'm using CurlUrl to "add/delete/overwrite some parts" how is that
> not "using it alone as a representation of an URL"?
>
>
What I meant here was that if you're not using curl, you have no advantage
of using this class alone to parse since the requester you're using could
handle the URL differently.


> If I'm writing a PSR-7 object, am I only supposed to use CurlUrl when
> interfacing with curl, and generate the string myself for other
> purposes? If the implementation I come up with differs from curl's, how
> does the user know which is the "real" URL?
>
>
You can use CurlUrl within your implementation of UriInterface but for the
same reason if you're using another request engine than curl, you may have
the same security problem where curl will not parse the same data. If you
want to make sure that your CurlUrl object represents the same thing as
your UriInterface you could build the CurlUrl object part by part using
your UriInterface. When you assign your CurlUrl to your CurlHandle with the
CURLOPT_CURLU option, curl will use the parts directly instead of parsing
the URL again, so you're sure that the host will be the one you set with
`CurlUrl::setHost()` and so on.

Pierrick

[1]
https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf

--0000000000005863f505e274a739--