AC-1843: Fixed path traversal issue for error reporting

nvshivakumar · nvshivakumar · commit 8430a4d30af0 · 2022-01-13T01:06:21.000+05:30
diff --git a/pub/errors/default/page.phtml b/pub/errors/default/page.phtml
@@ -3,12 +3,14 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+
+// phpcs:ignoreFile
 ?>
 <!doctype html>
 <html xmlns="http://www.w3.org/1999/xhtml" >
 <head>
     <title><?= $this->pageTitle ?></title>
-    <base href="<?= $this->getViewFileUrl() ?>" />
+    <base href="<?= $this->escaper->escapeHtml($this->getViewFileUrl()) ?>" />
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
     <meta name="robots" content="*"/>
     <link rel="stylesheet" href="css/styles.css" type="text/css" />
diff --git a/pub/errors/processor.php b/pub/errors/processor.php
@@ -270,7 +270,7 @@ public function getViewFileUrl()
         $errorPath = strpos($errorDir, $indexDir) === 0 ?
             str_replace($indexDir, '', $errorDir) : $errorPathSuffix;
 
-        return $this->getBaseUrl() . $errorPath . $this->_config->skin . '/';
+        return ltrim($this->getBaseUrl() . $errorPath . $this->_config->skin . '/','.');
     }
 
     /**
@@ -595,7 +595,7 @@ private function redirectToBaseUrl()
      */
     private function isReportIdValid(string $reportId): bool
     {
-        return (bool)preg_match('/[a-fA-F0-9]{64}/', $reportId);
+        return (bool)preg_match('/^[a-fA-F0-9]{64}$/', $reportId);
     }
 
     /**

Original file line number	Diff line number	Diff line change
`@@ -270,7 +270,7 @@ public function getViewFileUrl()`
`270`	`270`	`$errorPath = strpos($errorDir, $indexDir) === 0 ?`
`271`	`271`	`str_replace($indexDir, '', $errorDir) : $errorPathSuffix;`
`272`	`272`
`273`		`- return $this->getBaseUrl() . $errorPath . $this->_config->skin . '/';`
	`273`	`+ return ltrim($this->getBaseUrl() . $errorPath . $this->_config->skin . '/','.');`
`274`	`274`	`}`
`275`	`275`
`276`	`276`	`/**`
`@@ -595,7 +595,7 @@ private function redirectToBaseUrl()`
`595`	`595`	`*/`
`596`	`596`	`private function isReportIdValid(string $reportId): bool`
`597`	`597`	`{`
`598`		`- return (bool)preg_match('/[a-fA-F0-9]{64}/', $reportId);`
	`598`	`+ return (bool)preg_match('/^[a-fA-F0-9]{64}$/', $reportId);`
`599`	`599`	`}`
`600`	`600`
`601`	`601`	`/**`