Skip to content

Commit 1ec557f

Browse files
committed
Added: ability to match hostname to block open redirect vulns.
1 parent 26f4aef commit 1ec557f

6 files changed

Lines changed: 72 additions & 0 deletions

File tree

src/Extensions/ExtensionInterface.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,14 @@ public function forceExit($ruleId);
5151
*/
5252
public function getIpAddress();
5353

54+
/**
55+
* Get the hostname of the environment.
56+
* This is only used for open redirect vulnerabilities.
57+
*
58+
* @return string
59+
*/
60+
public function getHostName();
61+
5462
/**
5563
* Determine if the request should be passed without going through the firewall.
5664
*

src/Extensions/Test/Extension.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,17 @@ public function isWhitelisted($whitelistRules, $request)
7474
return false;
7575
}
7676

77+
/**
78+
* Get the hostname of the environment.
79+
* This is only used for open redirect vulnerabilities.
80+
*
81+
* @return string
82+
*/
83+
public function getHostName()
84+
{
85+
return 'wordpress.test';
86+
}
87+
7788
/**
7889
* Determine if the current request is a file upload request.
7990
*

src/Extensions/WordPress/Extension.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,17 @@ public function getIpAddress()
195195
return $this->core->get_ip();
196196
}
197197

198+
/**
199+
* Get the hostname of the environment.
200+
* This is only used for open redirect vulnerabilities.
201+
*
202+
* @return string
203+
*/
204+
public function getHostName()
205+
{
206+
return parse_url(home_url(), PHP_URL_HOST);
207+
}
208+
198209
/**
199210
* Check the custom whitelist rules defined in the backend of WordPress
200211
* and attempt to match it with the request.

src/Processor.php

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,21 @@ public function matchParameterValue($match, $value)
374374
return $this->matchParameterValue($match['match'], $value);
375375
}
376376

377+
// If the user provided value does not match the current hostname.
378+
if ($matchType == 'hostname' && is_string($value)) {
379+
if (empty($value)) {
380+
return false;
381+
}
382+
383+
// We only care about the hostname.
384+
$host = parse_url($value, PHP_URL_HOST);
385+
if (!$host) {
386+
return true;
387+
}
388+
389+
return $host !== $this->extension->getHostName();
390+
}
391+
377392
// If any of the uploaded files in the parameter matches a sub-match condition.
378393
if ($matchType == 'file_contains' && isset($match['match'])) {
379394
// Extract all tmp_names.

tests/FirewallTest.php

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,5 +226,24 @@ public function testRules()
226226
);
227227
$this->assertFalse($this->processor->launch(false));
228228
$this->alterPayload();
229+
230+
// Detect an open redirect vulnerability
231+
$this->setUpFirewallProcessor([$this->rules[15]]);
232+
$this->alterPayload(
233+
['GET' => [
234+
'tourl' => 'https://wordpress.test/my-location/'
235+
]]
236+
);
237+
$this->assertTrue($this->processor->launch(false));
238+
$this->alterPayload();
239+
240+
$this->setUpFirewallProcessor([$this->rules[15]]);
241+
$this->alterPayload(
242+
['GET' => [
243+
'tourl' => 'https://badsite.com'
244+
]]
245+
);
246+
$this->assertFalse($this->processor->launch(false));
247+
$this->alterPayload();
229248
}
230249
}

tests/data/Rules.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,5 +118,13 @@
118118
"cat":"TEST",
119119
"type":"BLOCK",
120120
"type_params":null
121+
},
122+
{
123+
"id":16,
124+
"title":"Determine if a URL parameter contains an open redirect vulnerability.",
125+
"rules":[{"parameter":"get.tourl","match":{"type":"hostname"}}],
126+
"cat":"TEST",
127+
"type":"BLOCK",
128+
"type_params":null
121129
}
122130
]

0 commit comments

Comments
 (0)