Fix CVE-2016-5385 "httpoxy"

# Conflicts: # CHANGELOG.md
amphp · Jul 18, 2016 · b60cf49 · b60cf49
1 parent 3e3eeda
commit b60cf49
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,8 @@
+v2.0.4
+------
+
+- Fix CVE-2016-5385 "httpoxy" vulnerability with environment variables
+
 v2.0.3
 ------
 

diff --git a/lib/HttpSocketPool.php b/lib/HttpSocketPool.php
@@ -23,6 +23,12 @@ public function __construct(SocketPool $sockPool = null, HttpTunneler $tunneler
     }
 
     private function autoDetectProxySettings() {
+        // See CVE-2016-5385, due to (emulation of) header copying with PHP web SAPIs into HTTP_* variables, HTTP_PROXY can be set by an user to any value he wants by setting the Proxy header
+        // Mitigate the vulnerability by only allowing CLI SAPIs to use HTTP(S)_PROXY environment variable
+        if (PHP_SAPI != "cli" && PHP_SAPI != "phpdbg" && PHP_SAPI != "embed") {
+            return;
+        }
+
         if (($httpProxy = getenv('http_proxy')) || ($httpProxy = getenv('HTTP_PROXY'))) {
             $this->options[self::OP_PROXY_HTTP] = $this->getUriAuthority($httpProxy);
         }