From: Tim Düsterhus <duesterhus@woltlab.com>
Date: Thu, 18 Mar 2021 10:51:09 +0000 (+0100)
Subject: Add RedirectGuard for Guzzle
X-Git-Tag: 5.4.0_Alpha_1~131^2~2
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=429fe39d431a32b4d9480e8bd545de617eefec67;p=GitHub%2FWoltLab%2FWCF.git

Add RedirectGuard for Guzzle
---

diff --git a/wcfsetup/install/files/lib/system/io/http/RedirectGuard.class.php b/wcfsetup/install/files/lib/system/io/http/RedirectGuard.class.php
new file mode 100644
index 0000000000..de97a294a7
--- /dev/null
+++ b/wcfsetup/install/files/lib/system/io/http/RedirectGuard.class.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace wcf\system\io\http;
+
+use GuzzleHttp\Exception\BadResponseException;
+use Psr\Http\Message\RequestInterface;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\UriInterface;
+
+/**
+ * The RedirectGuard prevents unsafe redirects from proceeding.
+ *
+ * Current checks:
+ * - Redirects to non-standard ports.
+ *
+ * @author  Tim Duesterhus
+ * @copyright   2001-2021 WoltLab GmbH
+ * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package WoltLabSuite\Core\System\Io\Http
+ * @since   5.4
+ */
+final class RedirectGuard
+{
+    /**
+     * @var null|callable
+     */
+    private $next;
+
+    /**
+     * @param ?callable $next The next callback to call after validation succeeds.
+     */
+    public function __construct(?callable $next = null)
+    {
+        $this->next = $next;
+    }
+
+    public function __invoke(RequestInterface $request, ResponseInterface $response, UriInterface $uri)
+    {
+        if ($uri->getPort() !== null) {
+            throw new BadResponseException(
+                "Refusing to follow redirects to non-standard ports.",
+                $request,
+                $response
+            );
+        }
+
+        if (($next = $this->next)) {
+            return $next($request, $response, $uri);
+        }
+    }
+}