12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091 |
- <?php
- declare(strict_types=1);
- namespace OC\Security;
- use OC\AppFramework\Http\Request;
- use OCP\IConfig;
- use OCP\Security\ITrustedDomainHelper;
- class TrustedDomainHelper implements ITrustedDomainHelper {
- public function __construct(
- private IConfig $config,
- ) {
- }
-
- private function getDomainWithoutPort(string $host): string {
- $pos = strrpos($host, ':');
- if ($pos !== false) {
- $port = substr($host, $pos + 1);
- if (is_numeric($port)) {
- $host = substr($host, 0, $pos);
- }
- }
- return $host;
- }
-
- public function isTrustedUrl(string $url): bool {
- $parsedUrl = parse_url($url);
- if (empty($parsedUrl['host'])) {
- return false;
- }
- if (isset($parsedUrl['port']) && $parsedUrl['port']) {
- return $this->isTrustedDomain($parsedUrl['host'] . ':' . $parsedUrl['port']);
- }
- return $this->isTrustedDomain($parsedUrl['host']);
- }
-
- public function isTrustedDomain(string $domainWithPort): bool {
-
- if ($this->config->getSystemValue('overwritehost') !== '') {
- return true;
- }
- $domain = $this->getDomainWithoutPort($domainWithPort);
-
- $trustedList = $this->config->getSystemValue('trusted_domains', []);
- if (!is_array($trustedList)) {
- return false;
- }
-
- if (preg_match(Request::REGEX_LOCALHOST, $domain) === 1) {
- return true;
- }
-
- if (str_starts_with($domain, '-') || str_contains($domain, '..')) {
- return false;
- }
-
- foreach ($trustedList as $trusted) {
- if (gettype($trusted) !== 'string') {
- break;
- }
- $regex = '/^' . implode('[-\.a-zA-Z0-9]*', array_map(function ($v) {
- return preg_quote($v, '/');
- }, explode('*', $trusted))) . '$/i';
- if (preg_match($regex, $domain) || preg_match($regex, $domainWithPort)) {
- return true;
- }
- }
- return false;
- }
- }
|