Merge branch 'hotfix/d8-2426489'

Fixes ZF2015-05.

Author: weierophinney

CHANGELOG.md

@@ -2,7 +2,27 @@
 
 All notable changes to this project will be documented in this file, in reverse chronological order by release.
 
-## 1.0.4 - TBD
+## 1.0.4 - 2015-06-23
+
+This is a security release.
+
+A patch has been applied to `Zend\Diactoros\Uri::filterPath()` that ensures that
+paths can only begin with a single leading slash. This prevents the following
+potential security issues:
+
+- XSS vectors. If the URI path is used for links or form targets, this prevents
+  cases where the first segment of the path resembles a domain name, thus
+  creating scheme-relative links such as `//example.com/foo`. With the patch,
+  the leading double slash is reduced to a single slash, preventing the XSS
+  vector.
+- Open redirects. If the URI path is used for `Location` or `Link` headers,
+  without a scheme and authority, potential for open redirects exist if clients
+  do not prepend the scheme and authority. Again, preventing a double slash
+  corrects the vector.
+
+If you are using `Zend\Diactoros\Uri` for creating links, form targets, or
+redirect paths, and only using the path segment, we recommend upgrading
+immediately.
 
 ### Added
 
@@ -39,6 +59,9 @@ All notable changes to this project will be documented in this file, in reverse
   - The request MUST return a `UriInterface` instance from `getUri()`; that
     instance CAN be empty. Previously, Diactoros would return `null`; now it
     lazy-instantiates an empty `Uri` instance on initialization.
+- [ZF2015-05](http://framework.zend.com/security/advisory/ZF2015-05) was
+  addressed by altering `Uri::filterPath()` to prevent emitting a path prepended
+  with multiple slashes.
 
 ## 1.0.3 - 2015-06-04
 

src/Uri.php

@@ -511,11 +511,24 @@ private function filterScheme($scheme)
      */
     private function filterPath($path)
     {
-        return preg_replace_callback(
+        $path = preg_replace_callback(
             '/(?:[^' . self::CHAR_UNRESERVED . ':@&=\+\$,\/;%]+|%(?![A-Fa-f0-9]{2}))/',
             [$this, 'urlEncodeChar'],
             $path
         );
+
+        if (empty($path)) {
+            // No path
+            return $path;
+        }
+
+        if ($path[0] !== '/') {
+            // Relative path
+            return $path;
+        }
+
+        // Ensure only one leading slash, to prevent XSS attempts.
+        return '/' . ltrim($path, '/');
     }
 
     /**

test/UriTest.php

@@ -448,4 +448,11 @@ public function testFragmentIsNotDoubleEncoded()
         $uri = (new Uri())->withFragment($expected);
         $this->assertEquals($expected, $uri->getFragment());
     }
+
+    public function testProperlyTrimsLeadingSlashesToPreventXSS()
+    {
+        $url = 'http://example.org//zend.com';
+        $uri = new Uri($url);
+        $this->assertEquals('http://example.org/zend.com', (string) $uri);
+    }
 }