[5.1] Quote user-supplied content for use in preg_match (#13059)

* Quote user-supplied content for use in preg_match * Remove preg_match silent error discarding * Use delimiter not used in the regex itself * Add tests for regex escaping
laravel · Apr 8, 2016 · dcef6c5 · dcef6c5
1 parent 0e73cba
commit dcef6c5
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/src/Illuminate/Http/Request.php b/src/Illuminate/Http/Request.php
@@ -583,8 +583,11 @@ public static function matchesType($actual, $type)
 
         $split = explode('/', $actual);
 
-        if (isset($split[1]) && @preg_match('/'.$split[0].'\/.+\+'.$split[1].'/', $type)) {
-            return true;
+        if (isset($split[1])) {
+            $split[0] = preg_quote($split[0], '#');
+            $split[1] = preg_quote($split[1], '#');
+
+            return preg_match('#'.$split[0].'/.+\+'.$split[1].'#', $type);
         }
 
         return false;

diff --git a/tests/Http/HttpRequestTest.php b/tests/Http/HttpRequestTest.php
@@ -517,6 +517,15 @@ public function testBadAcceptHeader()
         $this->assertFalse($request->accepts('application/baz+json'));
         $this->assertFalse($request->acceptsHtml());
         $this->assertFalse($request->acceptsJson());
+
+        // Should not be handled as regex.
+        $request = Request::create('/', 'GET', [], [], [], ['HTTP_ACCEPT' => '.+/.+']);
+        $this->assertFalse($request->accepts('application/json'));
+        $this->assertFalse($request->accepts('application/baz+json'));
+
+        // Should not produce compilation error on invalid regex.
+        $request = Request::create('/', 'GET', [], [], [], ['HTTP_ACCEPT' => '(/(']);
+        $this->assertFalse($request->accepts('text/html'));
     }
 
     /**