Repository navigation
fix(env): ignore CGI request metadata in $_SERVER as configuration - #44
Merged
Merged
Conversation
The reader treated every $_SERVER entry except HTTP_* as an external configuration source. Request metadata the web server derives from the request (REQUEST_*, QUERY_STRING, PATH_INFO, REDIRECT_*, REMOTE_*, SERVER_*, SCRIPT_*, ...) is now accepted only from the real process environment or $_ENV, the same rule HTTP_* already followed.
…olation The prefix list dropped operator values such as SERVER_ROLE passed through fastcgi_param. Match the RFC 3875 meta-variables and SAPI additions by exact name (plus HTTP_, REDIRECT_ and PHP_AUTH_ prefixes) and apply the same boundary to Dotenv interpolation and compiled templates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
Review finding R-S2 (informational):
EnvReadertreated every$_SERVERentry exceptHTTP_*as an external configuration source with the highest precedence, and Dotenv interpolation (${NAME}) fell back to$_SERVERas well. No catalog name collides with CGI metadata today, so this is a surface reduction, not a vulnerability.Change
REQUEST_URI,REQUEST_METHOD,QUERY_STRING,PATH_INFO,REMOTE_ADDR,SERVER_NAME,SCRIPT_FILENAME,DOCUMENT_ROOT,CONTENT_TYPE,HTTPS, … matched by exact name) plus everyHTTP_*,REDIRECT_*andPHP_AUTH_*entry follow the ruleHTTP_*already had: they are read only when$_ENVor the real process environment supplies them. Exact names keep operator values such asSERVER_ROLEpassed throughfastcgi_paramworking.interpolationExternalValue(), the compiled templates (EnvCacheTemplates::resolve()) and Dotenv's own$_SERVERfallback during parsing (EnvCacheInterpolation::parse()hides the referenced request names for the duration of the parse).EnvReader::isRequestMetaVariable()is@internal;docs/environment.mddocuments the boundary.Verification
tests/Unit/EnvReaderServerBoundaryTestcovers twelve request names, operator names with CGI-like prefixes, a request name supplied through$_ENV, and${REQUEST_URI:-fallback}interpolation.composer cs,composer static-analysisandtools/check-docs.pypass. Container-only failures are unchanged frommain.