Skip to content

Commit c50087d

Browse files
authored
Security Fix (#37675)
Fixed dns_get_record loose check of A records for active_url rule. Tested on Laravel v8.46.0, PHP v8.0.7. This patch is related to security issue I reported at https://huntr.dev/bounties/2-laravel/framework/.
1 parent ac66e87 commit c50087d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/Illuminate/Validation/Concerns/ValidatesAttributes.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ public function validateActiveUrl($attribute, $value)
5959

6060
if ($url = parse_url($value, PHP_URL_HOST)) {
6161
try {
62-
return count(dns_get_record($url, DNS_A | DNS_AAAA)) > 0;
62+
return count(dns_get_record($url.'.', DNS_A | DNS_AAAA)) > 0;
6363
} catch (Exception $e) {
6464
return false;
6565
}

0 commit comments

Comments
 (0)