Skip to content

Commit

Permalink
Make domain checking not via regex
Browse files Browse the repository at this point in the history
Use a case-insensitive comparison instead of vulnerable regex comparison

Fixes vulnerability wkcaj#24
  • Loading branch information
justinsteven committed Oct 4, 2019
1 parent a7c3d70 commit 701ce83
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/fin1te/SafeCurl/Options.php
Original file line number Diff line number Diff line change
Expand Up @@ -207,10 +207,10 @@ public function isInList($list, $type, $value) {
return false;
}

//For domains, a regex match is needed
//For domains, a case insensitive match is needed
if ($type == 'domain') {
foreach ($this->{$list}[$type] as $domain) {
if (preg_match('/^' . $domain . '$/i', $value)) {
if (!strcasecmp($domain, $value)) {
return true;
}
}
Expand Down

0 comments on commit 701ce83

Please sign in to comment.