strip all scheme parts in a URL in php

rubo77 0
Viewed 63

I want to fix this vulnerability, where the URL part of a PHP redirect is given by the query-string like

https://test.dev/test.php?return_page=contact.php

which will redirect to the other site contact.php.

An attacker could use this like:

https://test.dev/test.php?return_page=http://attack.hack

My idea is to strip double slashes in the function so the resulting redirect will be internal again and probably faulty:

$_GET['url']=str_replace("//","",$_GET['url']);

But maybe there is a better way to solve this with regex?

url replace string php
2 Answers

Have whitelist of allowed return-page parameters. If one is given which is it not allowed throw a 404 or forward to index.

$whitelist = ['contact.php', 'about.php'];

$returnPage = $_GET['return_page'] ?? '';

if (in_array($returnPage, $whitelist)) {
    header("Location: $returnPage");
    exit;
}

http_response_code(404)
exit;

If you anyways want to parse and verify the URL I recommend using parse_url.

Markus Zeller0

Just clean the URL of all possible scheme parts with

$url=preg_replace('/^([a-z0-9\s%;\+]+:\/\/+)+/i','',$_GET['url']);
header('Location: ' . $url)

i fixed that in https://github.com/rubo77/phpGACL

rubo770
Related