[LRDD] Fix unhandled bad data in HostMeta, LinkHTML and WebFinger

plugins/LRDD/lib/lrddmethod/hostmeta.php

@@ -1,4 +1,19 @@
 <?php
+// This file is part of GNU social - https://www.gnu.org/software/social
+//
+// GNU social is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// GNU social is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with GNU social.  If not, see <http://www.gnu.org/licenses/>.
+
 /**
  * Implementation of discovery using host-meta file
  *
@@ -6,11 +21,10 @@
  * organization's host-meta file and trying to find a template for LRDD.
  *
  * @category  Discovery
- * @package   StatusNet
+ * @package   GNUsocial
  * @author    James Walker <james@status.net>
  * @copyright 2010 StatusNet, Inc.
- * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @license   https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
- * @link      http://status.net/
  */
 class LRDDMethod_HostMeta extends LRDDMethod
 {
@@ -26,12 +40,14 @@ class LRDDMethod_HostMeta extends LRDDMethod
         $scheme = mb_strtolower(parse_url($uri, PHP_URL_SCHEME));
         switch ($scheme) {
         case 'acct':
-            if (!Discovery::isAcct($uri)) {
-                throw new Exception('Bad resource URI: '.$uri);
-            }
             // We can't use parse_url data for this, since the 'host'
             // entry is only set if the scheme has '://' after it.
-            list($user, $domain) = explode('@', parse_url($uri, PHP_URL_PATH));
+            $parts = explode('@', parse_url($uri, PHP_URL_PATH), 2);
+
+            if (!Discovery::isAcct($uri) || count($parts) != 2) {
+                throw new Exception('Bad resource URI: ' . $uri);
+            }
+            [, $domain] = $parts;
             break;
         case 'http':
         case 'https':

plugins/LRDD/lib/lrddmethod/linkhtml.php

@@ -1,4 +1,19 @@
 <?php
+// This file is part of GNU social - https://www.gnu.org/software/social
+//
+// GNU social is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// GNU social is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with GNU social.  If not, see <http://www.gnu.org/licenses/>.
+
 /**
  * Implementation of discovery using HTML <link> element
  *
@@ -6,11 +21,10 @@
  * <link> elements in the HTML response.
  *
  * @category  Discovery
- * @package   StatusNet
+ * @package   GNUsocial
  * @author    James Walker <james@status.net>
  * @copyright 2010 StatusNet, Inc.
- * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @license   https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
- * @link      http://status.net/
  */
 class LRDDMethod_LinkHTML extends LRDDMethod
 {
@@ -38,10 +52,14 @@ class LRDDMethod_LinkHTML extends LRDDMethod
      */
     public function parse($html)
     {
-        $links = array();
+        $links = [];
 
         preg_match('/<head(\s[^>]*)?>(.*?)<\/head>/is', $html, $head_matches);
-        $head_html = $head_matches[2];
+
+        if (count($head_matches) != 3) {
+            return [];
+        }
+        [,, $head_html] = $head_matches;
 
         preg_match_all('/<link\s[^>]*>/i', $head_html, $link_matches);
 
@@ -51,23 +69,23 @@ class LRDDMethod_LinkHTML extends LRDDMethod
             $link_type = null;
 
             preg_match('/\srel=(("|\')([^\\2]*?)\\2|[^"\'\s]+)/i', $link_html, $rel_matches);
-            if ( isset($rel_matches[3]) ) {
+            if (count($rel_matches) > 3) {
                 $link_rel = $rel_matches[3];
-            } else if ( isset($rel_matches[1]) ) {
+            } elseif (count($rel_matches) > 1) {
                 $link_rel = $rel_matches[1];
             }
 
             preg_match('/\shref=(("|\')([^\\2]*?)\\2|[^"\'\s]+)/i', $link_html, $href_matches);
-            if ( isset($href_matches[3]) ) {
+            if (count($href_matches) > 3) {
                 $link_uri = $href_matches[3];
-            } else if ( isset($href_matches[1]) ) {
+            } elseif (count($href_matches) > 1) {
                 $link_uri = $href_matches[1];
             }
 
             preg_match('/\stype=(("|\')([^\\2]*?)\\2|[^"\'\s]+)/i', $link_html, $type_matches);
-            if ( isset($type_matches[3]) ) {
+            if (count($type_matches) > 3) {
                 $link_type = $type_matches[3];
-            } else if ( isset($type_matches[1]) ) {
+            } elseif (count($type_matches) > 1) {
                 $link_type = $type_matches[1];
             }
 

plugins/LRDD/lib/lrddmethod/webfinger.php

@@ -1,13 +1,27 @@
 <?php
+// This file is part of GNU social - https://www.gnu.org/software/social
+//
+// GNU social is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// GNU social is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with GNU social.  If not, see <http://www.gnu.org/licenses/>.
+
 /**
  * Implementation of WebFinger resource discovery (RFC7033)
  *
  * @category  Discovery
  * @package   GNUsocial
  * @author    Mikael Nordfeldth <mmn@hethane.se>
- * @copyright 2013 Free Software Foundation, Inc.
+ * @copyright 2013 Free Software Foundation, Inc http://www.fsf.org
- * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html AGPL 3.0
+ * @license   https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
- * @link      http://status.net/
  */
 class LRDDMethod_WebFinger extends LRDDMethod
 {
@@ -17,21 +31,24 @@ class LRDDMethod_WebFinger extends LRDDMethod
      */
     public function discover($uri)
     {
-        if (!Discovery::isAcct($uri)) {
+        $parts = explode('@', parse_url($uri, PHP_URL_PATH), 2);
-            throw new Exception('Bad resource URI: '.$uri);
+
+        if (!Discovery::isAcct($uri) || count($parts) != 2) {
+            throw new Exception('Bad resource URI: ' . $uri);
         }
-        list($user, $domain) = explode('@', parse_url($uri, PHP_URL_PATH));
+        [, $domain] = $parts;
         if (!filter_var($domain, FILTER_VALIDATE_IP)
-                && !filter_var(gethostbyname($domain), FILTER_VALIDATE_IP)) {
+            && !filter_var(gethostbyname($domain), FILTER_VALIDATE_IP)) {
             throw new Exception('Bad resource host.');
         }
 
         $link = new XML_XRD_Element_Link(
-                        Discovery::LRDD_REL,
+            Discovery::LRDD_REL,
-                        'https://' . $domain . '/.well-known/webfinger?resource={uri}',
+            'https://' . $domain . '/.well-known/webfinger?resource={uri}',
-                        Discovery::JRD_MIMETYPE,
+            Discovery::JRD_MIMETYPE,
-                        true);  //isTemplate
+            true // isTemplate
+        );
 
-        return array($link);
+        return [$link];
     }
 }