Refuse to proxy non-standard ports in ImageProxy

diff --git a/wcfsetup/install/files/lib/action/ImageProxyAction.class.php b/wcfsetup/install/files/lib/action/ImageProxyAction.class.php
index 084c6ce3180fb41a83915a66fdf42784177ac6ad..23026f9d29ccbe7537e30d482bdec251861b9df0 100644 (file)
--- a/wcfsetup/install/files/lib/action/ImageProxyAction.class.php
+++ b/wcfsetup/install/files/lib/action/ImageProxyAction.class.php
@@ -12,6 +12,7 @@ use wcf\util\CryptoUtil;
 use wcf\util\FileUtil;
 use wcf\util\HeaderUtil;
 use wcf\util\StringUtil;
+use wcf\util\Url;
 
 /**
  * Proxies requests for embedded images.
@@ -82,16 +83,20 @@ class ImageProxyAction extends AbstractAction {
                                
                                try {
                                        // rewrite schemaless URLs to https
-                                       $scheme = parse_url($url, PHP_URL_SCHEME);
+                                       $scheme = Url::parse($url)['scheme'];
                                        if (!$scheme) {
                                                if (StringUtil::startsWith($url, '//')) {
                                                        $url = 'https:'.$url;
                                                }
                                                else {
-                                                       throw new \DomainException();
+                                                       throw new \DomainException("Refusing to proxy a schemaless URL that does not start with //");
                                                }
                                        }
                                        
+                                       if (Url::parse($url)['port']) {
+                                               throw new \DomainException("Refusing to proxy non-standard ports.");
+                                       }
+                                       
                                        // download image
                                        try {
                                                $client = HttpFactory::makeClient([