bug symfony#25373 Use the PCRE_DOLLAR_ENDONLY modifier in route regexes (mpdude)

nicolas-grekas · nicolas-grekas · commit 478fbdc24115 · 2018-02-04T16:51:07.000+01:00
This PR was squashed before being merged into the 2.7 branch (closes symfony#25373). Discussion ---------- Use the PCRE_DOLLAR_ENDONLY modifier in route regexes | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | `UrlMatcher::match($pathinfo)` applies `rawurldecode()` to the `$pathinfo` before trying to match it against the routes. If the URL contains a percent-encoded trailing newline (like in `/foo%0a`), the default PHP PCRE will still consider `#^/foo$#` a match, as the `$` metacharacter will also match *immediately before* the final character *if it is a newline*. This behavior can be changed by applying the [`PCRE_DOLLAR_ENDONLY` modifier](http://php.net/manual/en/reference.pcre.pattern.modifiers.php). Without this change, URLs with trailing `%0a` lead to weird notices further down the road, for example when the `RedirectableUrlMatcher` or its equivalent in `PhpMatcherDumper` kick in, look at the last character (this time actually the newline), append a `/` and try to redirect to the resulting URL. Ultimately, PHP will complain with `Warning: Header may not contain more than a single header, new line detected` when sending the `Location` header. Commits ------- f713a3e Use the PCRE_DOLLAR_ENDONLY modifier in route regexes
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Console/Descriptor/ObjectsProvider.php b/src/Symfony/Bundle/FrameworkBundle/Tests/Console/Descriptor/ObjectsProvider.php
@@ -18,6 +18,7 @@
 use Symfony\Component\DependencyInjection\Reference;
 use Symfony\Component\EventDispatcher\EventDispatcher;
 use Symfony\Component\Routing\Route;
+use Symfony\Component\Routing\CompiledRoute;
 use Symfony\Component\Routing\RouteCollection;
 
 class ObjectsProvider
@@ -35,7 +36,7 @@ public static function getRouteCollections()
     public static function getRoutes()
     {
         return array(
-            'route_1' => new Route(
+            'route_1' => new RouteStub(
                 '/hello/{name}',
                 array('name' => 'Joseph'),
                 array('name' => '[a-z]+'),
@@ -44,7 +45,7 @@ public static function getRoutes()
                 array('http', 'https'),
                 array('get', 'head')
             ),
-            'route_2' => new Route(
+            'route_2' => new RouteStub(
                 '/name/add',
                 array(),
                 array(),
@@ -207,3 +208,11 @@ public static function staticMethod()
     {
     }
 }
+
+class RouteStub extends Route
+{
+    public function compile()
+    {
+        return new CompiledRoute('', '#PATH_REGEX#', array(), array(), '#HOST_REGEX#');
+    }
+}
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.json b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.json
@@ -1,11 +1,11 @@
 {
     "path": "\/hello\/{name}",
-    "pathRegex": "#^\/hello(?:\/(?P<name>[a-z]+))?$#s",
+    "pathRegex": "#PATH_REGEX#",
     "host": "localhost",
-    "hostRegex": "#^localhost$#si",
+    "hostRegex": "#HOST_REGEX#",
     "scheme": "http|https",
     "method": "GET|HEAD",
-    "class": "Symfony\\Component\\Routing\\Route",
+    "class": "Symfony\\Bundle\\FrameworkBundle\\Tests\\Console\\Descriptor\\RouteStub",
     "defaults": {
         "name": "Joseph"
     },
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.md b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.md
@@ -1,10 +1,10 @@
 - Path: /hello/{name}
-- Path Regex: #^/hello(?:/(?P<name>[a-z]+))?$#s
+- Path Regex: #PATH_REGEX#
 - Host: localhost
-- Host Regex: #^localhost$#si
+- Host Regex: #HOST_REGEX#
 - Scheme: http|https
 - Method: GET|HEAD
-- Class: Symfony\Component\Routing\Route
+- Class: Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub
 - Defaults: 
     - `name`: Joseph
 - Requirements: 
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.txt b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.txt
@@ -1,10 +1,10 @@
 <comment>Path</comment>         /hello/{name}
-<comment>Path Regex</comment>   #^/hello(?:/(?P<name>[a-z]+))?$#s
+<comment>Path Regex</comment>   #PATH_REGEX#
 <comment>Host</comment>         localhost
-<comment>Host Regex</comment>   #^localhost$#si
+<comment>Host Regex</comment>   #HOST_REGEX#
 <comment>Scheme</comment>       http|https
 <comment>Method</comment>       GET|HEAD
-<comment>Class</comment>        Symfony\Component\Routing\Route
+<comment>Class</comment>        Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub
 <comment>Defaults</comment>     name: Joseph
 <comment>Requirements</comment> name: [a-z]+
 <comment>Options</comment>      compiler_class: Symfony\Component\Routing\RouteCompiler
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.xml b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_1.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<route class="Symfony\Component\Routing\Route">
-  <path regex="#^/hello(?:/(?P&lt;name&gt;[a-z]+))?$#s">/hello/{name}</path>
-  <host regex="#^localhost$#si">localhost</host>
+<route class="Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub">
+  <path regex="#PATH_REGEX#">/hello/{name}</path>
+  <host regex="#HOST_REGEX#">localhost</host>
   <scheme>http</scheme>
   <scheme>https</scheme>
   <method>GET</method>
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.json b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.json
@@ -1,11 +1,11 @@
 {
     "path": "\/name\/add",
-    "pathRegex": "#^\/name\/add$#s",
+    "pathRegex": "#PATH_REGEX#",
     "host": "localhost",
-    "hostRegex": "#^localhost$#si",
+    "hostRegex": "#HOST_REGEX#",
     "scheme": "http|https",
     "method": "PUT|POST",
-    "class": "Symfony\\Component\\Routing\\Route",
+    "class": "Symfony\\Bundle\\FrameworkBundle\\Tests\\Console\\Descriptor\\RouteStub",
     "defaults": [],
     "requirements": "NO CUSTOM",
     "options": {
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.md b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.md
@@ -1,10 +1,10 @@
 - Path: /name/add
-- Path Regex: #^/name/add$#s
+- Path Regex: #PATH_REGEX#
 - Host: localhost
-- Host Regex: #^localhost$#si
+- Host Regex: #HOST_REGEX#
 - Scheme: http|https
 - Method: PUT|POST
-- Class: Symfony\Component\Routing\Route
+- Class: Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub
 - Defaults: NONE
 - Requirements: NO CUSTOM
 - Options: 
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.txt b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.txt
@@ -1,10 +1,10 @@
 <comment>Path</comment>         /name/add
-<comment>Path Regex</comment>   #^/name/add$#s
+<comment>Path Regex</comment>   #PATH_REGEX#
 <comment>Host</comment>         localhost
-<comment>Host Regex</comment>   #^localhost$#si
+<comment>Host Regex</comment>   #HOST_REGEX#
 <comment>Scheme</comment>       http|https
 <comment>Method</comment>       PUT|POST
-<comment>Class</comment>        Symfony\Component\Routing\Route
+<comment>Class</comment>        Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub
 <comment>Defaults</comment>     NONE
 <comment>Requirements</comment> NO CUSTOM
 <comment>Options</comment>      compiler_class: Symfony\Component\Routing\RouteCompiler
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.xml b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_2.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<route class="Symfony\Component\Routing\Route">
-  <path regex="#^/name/add$#s">/name/add</path>
-  <host regex="#^localhost$#si">localhost</host>
+<route class="Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub">
+  <path regex="#PATH_REGEX#">/name/add</path>
+  <host regex="#HOST_REGEX#">localhost</host>
   <scheme>http</scheme>
   <scheme>https</scheme>
   <method>PUT</method>
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_collection_1.json b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_collection_1.json
@@ -1,12 +1,12 @@
 {
     "route_1": {
         "path": "\/hello\/{name}",
-        "pathRegex": "#^\/hello(?:\/(?P<name>[a-z]+))?$#s",
+        "pathRegex": "#PATH_REGEX#",
         "host": "localhost",
-        "hostRegex": "#^localhost$#si",
+        "hostRegex": "#HOST_REGEX#",
         "scheme": "http|https",
         "method": "GET|HEAD",
-        "class": "Symfony\\Component\\Routing\\Route",
+        "class": "Symfony\\Bundle\\FrameworkBundle\\Tests\\Console\\Descriptor\\RouteStub",
         "defaults": {
             "name": "Joseph"
         },
@@ -21,12 +21,12 @@
     },
     "route_2": {
         "path": "\/name\/add",
-        "pathRegex": "#^\/name\/add$#s",
+        "pathRegex": "#PATH_REGEX#",
         "host": "localhost",
-        "hostRegex": "#^localhost$#si",
+        "hostRegex": "#HOST_REGEX#",
         "scheme": "http|https",
         "method": "PUT|POST",
-        "class": "Symfony\\Component\\Routing\\Route",
+        "class": "Symfony\\Bundle\\FrameworkBundle\\Tests\\Console\\Descriptor\\RouteStub",
         "defaults": [],
         "requirements": "NO CUSTOM",
         "options": {
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_collection_1.md b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_collection_1.md
@@ -2,12 +2,12 @@ route_1
 -------
 
 - Path: /hello/{name}
-- Path Regex: #^/hello(?:/(?P<name>[a-z]+))?$#s
+- Path Regex: #PATH_REGEX#
 - Host: localhost
-- Host Regex: #^localhost$#si
+- Host Regex: #HOST_REGEX#
 - Scheme: http|https
 - Method: GET|HEAD
-- Class: Symfony\Component\Routing\Route
+- Class: Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub
 - Defaults: 
     - `name`: Joseph
 - Requirements: 
@@ -22,12 +22,12 @@ route_2
 -------
 
 - Path: /name/add
-- Path Regex: #^/name/add$#s
+- Path Regex: #PATH_REGEX#
 - Host: localhost
-- Host Regex: #^localhost$#si
+- Host Regex: #HOST_REGEX#
 - Scheme: http|https
 - Method: PUT|POST
-- Class: Symfony\Component\Routing\Route
+- Class: Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub
 - Defaults: NONE
 - Requirements: NO CUSTOM
 - Options: 
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_collection_1.xml b/src/Symfony/Bundle/FrameworkBundle/Tests/Fixtures/Descriptor/route_collection_1.xml
@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <routes>
-  <route name="route_1" class="Symfony\Component\Routing\Route">
-    <path regex="#^/hello(?:/(?P&lt;name&gt;[a-z]+))?$#s">/hello/{name}</path>
-    <host regex="#^localhost$#si">localhost</host>
+  <route name="route_1" class="Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub">
+    <path regex="#PATH_REGEX#">/hello/{name}</path>
+    <host regex="#HOST_REGEX#">localhost</host>
     <scheme>http</scheme>
     <scheme>https</scheme>
     <method>GET</method>
@@ -19,9 +19,9 @@
       <option key="opt2">val2</option>
     </options>
   </route>
-  <route name="route_2" class="Symfony\Component\Routing\Route">
-    <path regex="#^/name/add$#s">/name/add</path>
-    <host regex="#^localhost$#si">localhost</host>
+  <route name="route_2" class="Symfony\Bundle\FrameworkBundle\Tests\Console\Descriptor\RouteStub">
+    <path regex="#PATH_REGEX#">/name/add</path>
+    <host regex="#HOST_REGEX#">localhost</host>
     <scheme>http</scheme>
     <scheme>https</scheme>
     <method>PUT</method>
diff --git a/src/Symfony/Component/Routing/RouteCompiler.php b/src/Symfony/Component/Routing/RouteCompiler.php
@@ -177,7 +177,7 @@ private static function compilePattern(Route $route, $pattern, $isHost)
 
         return array(
             'staticPrefix' => 'text' === $tokens[0][0] ? $tokens[0][1] : '',
-            'regex' => self::REGEX_DELIMITER.'^'.$regexp.'$'.self::REGEX_DELIMITER.'s'.($isHost ? 'i' : ''),
+            'regex' => self::REGEX_DELIMITER.'^'.$regexp.'$'.self::REGEX_DELIMITER.'sD'.($isHost ? 'i' : ''),
             'tokens' => array_reverse($tokens),
             'variables' => $variables,
         );
diff --git a/src/Symfony/Component/Routing/Tests/Fixtures/dumper/url_matcher1.php b/src/Symfony/Component/Routing/Tests/Fixtures/dumper/url_matcher1.php
diff --git a/src/Symfony/Component/Routing/Tests/Fixtures/dumper/url_matcher2.php b/src/Symfony/Component/Routing/Tests/Fixtures/dumper/url_matcher2.php
diff --git a/src/Symfony/Component/Routing/Tests/Fixtures/dumper/url_matcher3.php b/src/Symfony/Component/Routing/Tests/Fixtures/dumper/url_matcher3.php
diff --git a/src/Symfony/Component/Routing/Tests/Matcher/UrlMatcherTest.php b/src/Symfony/Component/Routing/Tests/Matcher/UrlMatcherTest.php
diff --git a/src/Symfony/Component/Routing/Tests/RouteCompilerTest.php b/src/Symfony/Component/Routing/Tests/RouteCompilerTest.php
diff --git a/src/Symfony/Component/Routing/Tests/RouteTest.php b/src/Symfony/Component/Routing/Tests/RouteTest.php
