Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add warning if host is accessed via verify_peer or verify_peer_name disabled #10722

Merged
merged 1 commit into from Apr 13, 2022
Merged

Add warning if host is accessed via verify_peer or verify_peer_name disabled #10722

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
32 changes: 25 additions & 7 deletions src/Composer/Config.php
View file
Open in desktop
Expand Up @@ -107,6 +107,8 @@ class Config
private $useEnvironment;
/** @var array<string, true> */
private $warnedHosts = array();
/** @var array<string, true> */
private $sslVerifyWarnedHosts = array();
/** @var array<string, string> */
private $sourceOfConfigValue = array();

Expand Down Expand Up @@ -575,10 +577,11 @@ private function disableRepoByName(string $name): void
*
* @param string $url
* @param IOInterface $io
* @param mixed[] $repoOptions
*
* @return void
*/
public function prohibitUrlByConfig(string $url, IOInterface $io = null): void
public function prohibitUrlByConfig(string $url, IOInterface $io = null, array $repoOptions = []): void
{
// Return right away if the URL is malformed or custom (see issue #5173)
if (false === filter_var($url, FILTER_VALIDATE_URL)) {
Expand All @@ -600,16 +603,31 @@ public function prohibitUrlByConfig(string $url, IOInterface $io = null): void

throw new TransportException("Your configuration does not allow connections to $url. See https://getcomposer.org/doc/06-config.md#secure-http for details.");
}
if ($io) {
$host = parse_url($url, PHP_URL_HOST);
if (is_string($host)) {
if (!isset($this->warnedHosts[$host])) {
$io->writeError("<warning>Warning: Accessing $host over $scheme which is an insecure protocol.</warning>");
if ($io !== null) {
if (is_string($hostname)) {
if (!isset($this->warnedHosts[$hostname])) {
$io->writeError("<warning>Warning: Accessing $hostname over $scheme which is an insecure protocol.</warning>");
}
$this->warnedHosts[$host] = true;
$this->warnedHosts[$hostname] = true;
}
}
}

if ($io !== null && is_string($hostname) && !isset($this->sslVerifyWarnedHosts[$hostname])) {
$warning = null;
if (isset($repoOptions['ssl']['verify_peer']) && !(bool) $repoOptions['ssl']['verify_peer']) {
$warning = 'verify_peer';
}

if (isset($repoOptions['ssl']['verify_peer_name']) && !(bool) $repoOptions['ssl']['verify_peer_name']) {
$warning = $warning === null ? 'verify_peer_name' : $warning . ' and verify_peer_name';
}

if ($warning !== null) {
$io->writeError("<warning>Warning: Accessing $hostname with $warning disabled.</warning>");
$this->sslVerifyWarnedHosts[$hostname] = true;
}
}
}

/**
Expand Down
2 changes: 1 addition & 1 deletion src/Composer/Util/Http/CurlDownloader.php
View file
Open in desktop
Expand Up @@ -168,7 +168,7 @@ private function initDownload(callable $resolve, callable $reject, string $origi

// check URL can be accessed (i.e. is not insecure), but allow insecure Packagist calls to $hashed providers as file integrity is verified with sha256
if (!Preg::isMatch('{^http://(repo\.)?packagist\.org/p/}', $url) || (false === strpos($url, '$') && false === strpos($url, '%24'))) {
$this->config->prohibitUrlByConfig($url, $this->io);
$this->config->prohibitUrlByConfig($url, $this->io, $options);
}

$curlHandle = curl_init();
Expand Down
21 changes: 21 additions & 0 deletions tests/Composer/Test/ConfigTest.php
View file
Open in desktop
Expand Up @@ -13,6 +13,9 @@
namespace Composer\Test;

use Composer\Config;
use Composer\IO\BaseIO;
use Composer\IO\IOInterface;
use Composer\IO\NullIO;
use Composer\Util\Platform;

class ConfigTest extends TestCase
Expand Down Expand Up @@ -308,6 +311,24 @@ public function prohibitedUrlProvider(): array
}, $urls));
}

public function testProhibitedUrlsWarningVerifyPeer(): void
{
$io = $this->getMockBuilder(IOInterface::class)->disableOriginalConstructor()->getMock();

$io
->expects($this->once())
->method('writeError')
->with($this->equalTo('<warning>Warning: Accessing example.org with verify_peer and verify_peer_name disabled.</warning>'));

$config = new Config(false);
$config->prohibitUrlByConfig('https://example.org', $io, [
'ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
]
]);
}

/**
* @group TLS
*/
Expand Down