Skip to content

Commit b759361

Browse files
phy25phy25
authored
Merge pull request from GHSA-8q72-6qq8-xv64
* Add ServerName classes and required service_name constructor argument This includes a refactoring of moving Client->_getClientUrl() method to a new class. Unit tests are also added and updated for the new constructor argument. * Add service_name argument to the static helper class and examples * Update docs for 1.6.0 release * Update versions for the 1.6.0 release * Rename ServerName class to ServiceBaseUrl and add protocol in allowedlist check * Update docs for the ServiceBaseUrl class and argument change * Minor typo fixes
1 parent 49160be commit b759361

40 files changed

+789
-91
lines changed

‎docs/ChangeLog

+19-12
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,18 @@
1+
Changes in version 1.6.0
2+
3+
Bug Fixes:
4+
* Introduce required service_name constructor argument to fix
5+
service hostname discovery exploitation vulnerability (Henry Pan)
6+
* Set user agent [#421] (Fydon)
7+
18
Changes in version 1.5.0
29

310
Bug Fixes:
411
* Fix undefined variables [#417] (Dawid Polak)
512
* Fix client when getting ticket and it's null [#415] (Quentin Belot)
613
* Allow autoloader to detect trait_exists() [#394] (Jean-Luc Herren)
714
* Use curl_setopt_array instead of loop in CurlRequest [#391] (François Freitag)
8-
15+
916
Improvement:
1017
* Disable printf when verbosity flag is not set to true [#396] (Michał Kleszczyński)
1118
* Disabling error printing based on verbosity flag [#393] (Michał Kleszczyński)
@@ -21,18 +28,18 @@ Bug Fixes:
2128
* Fix use of deprecated setDebug() in examples [#360] (Joachim Fritschi)
2229
* Fix session_set_save_handler error [#365] (Joachim Fritschi)
2330
* Fix wrong server_port documentation [#369] (Joachim Fritschi)
24-
31+
2532
Improvement:
2633
* support samesite cookies attribute (#370) (Mickael)
2734
* Remove PHP5 support [#366] (Joachim Fritschi)
28-
29-
35+
36+
3037
Changes in version 1.3.9
3138

3239
Bug Fixes:
3340
* Fix regression of #248: Support of longer session tickets (#349) (Alan Nelson)
3441
* Fix private call generating php warning and no logout handling (#352) (Julien Gribonvald)
35-
42+
3643
Improvement:
3744
* Add support for logging via a PSR-3 logger [#329] (Jon Dufresne)
3845
* Improve attribute handling [#317] (Tobias Schiebeck)
@@ -46,7 +53,7 @@ Changes in version 1.3.8
4653

4754
Bug Fixes:
4855
* Fix pear package [#297] (Phil Fenstermacher)
49-
56+
5057
Improvement:
5158
* Adding support for PROXY CALLBACK using POST parameters instead of GET [#312]
5259

@@ -57,8 +64,8 @@ Bug Fixes:
5764

5865
Improvement:
5966
* add method to get list of supported protocols (#293) Julien Boulen
60-
61-
67+
68+
6269
Changes in version 1.3.6
6370

6471
Security Fixes:
@@ -68,7 +75,7 @@ Bug Fixes:
6875
* Fix bad condition [#252] (Brice Vercoustre)
6976
* Hash ticket strings to generate valid-length session-ids [#224, #244, #248] (Adam Franco)
7077
* Fix "phpCAS" class capitalization in code [#273, #277] (phy25)
71-
78+
7279
Improvement:
7380
* Remove fallback for __autoload [#247] (marinaglancy)
7481
* More robust check for Windows OS in File.php [#275] (xamount)
@@ -125,8 +132,8 @@ Improvement:
125132
* Add time to trace [#158] (cwsterling)
126133
* Add php5.6 tests, move to faster docker env [#169] (Florian Holzhauer)
127134
* Introduce a setVerbose() toggle to prevent debug info leaking in production [#152 #147] (Joachim Fritschi)
128-
129-
135+
136+
130137
Changes in version 1.3.3
131138
Security Fixes:
132139
* CVE-2014-4172 Urlencode all tickets [#125] (Marvin Addison)
@@ -140,7 +147,7 @@ Bug Fixes:
140147
* Fix missing Server_Admin variable for nginex [#121](arianf)
141148
* Fix error in TypeMismatchException [#123 ](Develle)
142149
* Fix bug in https test [#126] (Florent Baldino)
143-
150+
144151

145152
Improvement:
146153
* Fix grammar of documentation [#61] (frett)

‎docs/Upgrading

+34
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,37 @@
1+
################################
2+
### Upgrading 1.5.0 -> 1.6.0 ###
3+
################################
4+
5+
phpCAS now requires an additional service base URL argument when constructing
6+
the client class, similar to other CAS client's serverName config. It accepts
7+
any argument of:
8+
9+
1. A service base URL string. The service URL discovery will always use this
10+
server name (protocol, hostname and port number) without using any external
11+
host names.
12+
2. An array of service base URL strings. The service URL discovery will check
13+
against this list before using the auto discovered base URL. If there is no
14+
match, the first base URL in the array will be used as the default. This
15+
option is helpful if your PHP website is accessible through multiple domains
16+
without a canonical name, or through both HTTP and HTTPS.
17+
3. A class that implements CAS_ServiceBaseUrl_Interface. If you need to
18+
customize the base URL discovery behavior, you can pass in a class that
19+
implements the interface.
20+
21+
For option 1 and 2, protocol, hostname and port should all appear without a
22+
trailing slash, e.g. http://example.org:8080. You can omit the default port for
23+
the protocol, which means use https://example.org instead of
24+
https://example.org:443 (if you use HTTPS).
25+
26+
For security reasons, we no longer allow service base URL discovery without an
27+
allowed list check by default. For more information, refer to the security
28+
advisory.
29+
30+
This version also changed the CURL User Agent string that phpCAS uses when
31+
sending validation requests to the CAS server. It will appear as phpCAS/1.6.0
32+
with the version number reflecting the library version.
33+
34+
135
################################
236
### Upgrading 1.3.3 -> 1.3.4 ###
337
################################

‎docs/examples/config.example.php

+3
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@
4343
// Assumes the cas server is load balanced across multiple hosts
4444
$cas_real_hosts = array('cas-real-1.example.com', 'cas-real-2.example.com');
4545

46+
// Client config for the required domain name, should be protocol, hostname and port
47+
$client_service_name = 'http://127.0.0.1';
48+
4649
// Client config for cookie hardening
4750
$client_domain = '127.0.0.1';
4851
$client_path = 'phpcas';

‎docs/examples/create_pgt_storage_db_table.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
// Dummy client because we need a 'client' object
3030
$client = new CAS_Client(
31-
CAS_VERSION_2_0, true, $cas_host, $cas_port, $cas_context, false
31+
CAS_VERSION_2_0, true, $cas_host, $cas_port, $cas_context, $client_service_name, false
3232
);
3333

3434
// Set the torage object

‎docs/examples/example_advanced_saml11.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_custom_urls.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_gateway.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_hardening.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
session_set_cookie_params($client_lifetime, $client_path, $client_domain, $client_secure, $client_httpOnly);
2929

3030
// Initialize phpCAS
31-
phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context);
31+
phpCAS::client(SAML_VERSION_1_1, $cas_host, $cas_port, $cas_context, $client_service_name);
3232

3333
// For production use set the CA certificate that is the issuer of the cert
3434
// on the CAS server and uncomment the line below

‎docs/examples/example_html.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_lang.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_logout.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_no_ssl_cn_validation.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_pgt_storage_db.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_pgt_storage_file.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_proxy_GET.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_proxy_POST.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_proxy_rebroadcast.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
phpCAS::setVerbose(true);
2727

2828
// Initialize phpCAS
29-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
29+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
3030

3131
// For production use set the CA certificate that is the issuer of the cert
3232
// on the CAS server and uncomment the line below

‎docs/examples/example_proxy_serviceWeb.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_proxy_serviceWeb_chaining.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_renew.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_service.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_service_POST.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_service_that_proxies.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::proxy(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎docs/examples/example_simple.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
phpCAS::setVerbose(true);
2626

2727
// Initialize phpCAS
28-
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
28+
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context, $client_service_name);
2929

3030
// For production use set the CA certificate that is the issuer of the cert
3131
// on the CAS server and uncomment the line below

‎source/CAS.php

+22-4
Original file line numberDiff line numberDiff line change
@@ -327,6 +327,14 @@ class phpCAS
327327
* @param string $server_hostname the hostname of the CAS server
328328
* @param int $server_port the port the CAS server is running on
329329
* @param string $server_uri the URI the CAS server is responding on
330+
* @param string|string[]|CAS_ServiceBaseUrl_Interface
331+
* $service_base_url the base URL (protocol, host and the
332+
* optional port) of the CAS client; pass
333+
* in an array to use auto discovery with
334+
* an allowlist; pass in
335+
* CAS_ServiceBaseUrl_Interface for custom
336+
* behavior. Added in 1.6.0. Similar to
337+
* serverName config in other CAS clients.
330338
* @param bool $changeSessionID Allow phpCAS to change the session_id
331339
* (Single Sign Out/handleLogoutRequests
332340
* is based on that change)
@@ -338,7 +346,8 @@ class phpCAS
338346
* and phpCAS::setDebug()).
339347
*/
340348
public static function client($server_version, $server_hostname,
341-
$server_port, $server_uri, $changeSessionID = true, \SessionHandlerInterface $sessionHandler = null
349+
$server_port, $server_uri, $service_base_url,
350+
$changeSessionID = true, \SessionHandlerInterface $sessionHandler = null
342351
) {
343352
phpCAS :: traceBegin();
344353
if (is_object(self::$_PHPCAS_CLIENT)) {
@@ -357,7 +366,7 @@ public static function client($server_version, $server_hostname,
357366
// initialize the object $_PHPCAS_CLIENT
358367
try {
359368
self::$_PHPCAS_CLIENT = new CAS_Client(
360-
$server_version, false, $server_hostname, $server_port, $server_uri,
369+
$server_version, false, $server_hostname, $server_port, $server_uri, $service_base_url,
361370
$changeSessionID, $sessionHandler
362371
);
363372
} catch (Exception $e) {
@@ -373,6 +382,14 @@ public static function client($server_version, $server_hostname,
373382
* @param string $server_hostname the hostname of the CAS server
374383
* @param string $server_port the port the CAS server is running on
375384
* @param string $server_uri the URI the CAS server is responding on
385+
* @param string|string[]|CAS_ServiceBaseUrl_Interface
386+
* $service_base_url the base URL (protocol, host and the
387+
* optional port) of the CAS client; pass
388+
* in an array to use auto discovery with
389+
* an allowlist; pass in
390+
* CAS_ServiceBaseUrl_Interface for custom
391+
* behavior. Added in 1.6.0. Similar to
392+
* serverName config in other CAS clients.
376393
* @param bool $changeSessionID Allow phpCAS to change the session_id
377394
* (Single Sign Out/handleLogoutRequests
378395
* is based on that change)
@@ -384,7 +401,8 @@ public static function client($server_version, $server_hostname,
384401
* and phpCAS::setDebug()).
385402
*/
386403
public static function proxy($server_version, $server_hostname,
387-
$server_port, $server_uri, $changeSessionID = true, \SessionHandlerInterface $sessionHandler = null
404+
$server_port, $server_uri, $service_base_url,
405+
$changeSessionID = true, \SessionHandlerInterface $sessionHandler = null
388406
) {
389407
phpCAS :: traceBegin();
390408
if (is_object(self::$_PHPCAS_CLIENT)) {
@@ -403,7 +421,7 @@ public static function proxy($server_version, $server_hostname,
403421
// initialize the object $_PHPCAS_CLIENT
404422
try {
405423
self::$_PHPCAS_CLIENT = new CAS_Client(
406-
$server_version, true, $server_hostname, $server_port, $server_uri,
424+
$server_version, true, $server_hostname, $server_port, $server_uri, $service_base_url,
407425
$changeSessionID, $sessionHandler
408426
);
409427
} catch (Exception $e) {

0 commit comments

Comments
 (0)