'ScieloXML/sci_clinicaltrials.xis',
+ 'pid' => $pid,
+ ));
$xmlFile = file_get_contents($serviceUrl);
//die($xmlFile);
preg_match_all('/
/',$xmlFile,$arrResult);
diff --git a/htdocs/scieloOrg/php/projfapesp.php b/htdocs/scieloOrg/php/projfapesp.php
index d68785586..c4cc79b08 100644
--- a/htdocs/scieloOrg/php/projfapesp.php
+++ b/htdocs/scieloOrg/php/projfapesp.php
@@ -4,8 +4,11 @@
$lang = isset($_REQUEST['lang'])?($_REQUEST['lang']):"";
$pid = isset($_REQUEST['pid'])?($_REQUEST['pid']):"";
- require_once(dirname(__FILE__)."/../../applications/scielo-org/users/langs.php");
- $defFile = parse_ini_file(dirname(__FILE__)."/../../scielo.def.php");
+ require_once(dirname(__FILE__)."/../../applications/scielo-org/users/langs.php");
+ require_once(dirname(__FILE__)."/../../security.php");
+ $defFile = parse_ini_file(dirname(__FILE__)."/../../scielo.def.php");
+ $scieloConfig = parse_ini_file(dirname(__FILE__)."/../../scielo.def.php", true);
+ $internalHost = scielo_internal_host_from_config($scieloConfig);
?>
@@ -80,7 +83,10 @@
'ScieloXML/sci_projfapesp.xis',
+ 'pid' => $pid,
+ ));
$xmlFile = file_get_contents($serviceUrl);
diff --git a/htdocs/scielolog.php b/htdocs/scielolog.php
index b4086b903..0bb87dccd 100644
--- a/htdocs/scielolog.php
+++ b/htdocs/scielolog.php
@@ -2,7 +2,7 @@
include ("classScieloLogOfi.php");
// Create new Scielo object
- $host = $HTTP_HOST;
+ $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
$scielo = new ScieloLog ($host);
$script = $_REQUEST["script"];
$dti = $_REQUEST["dti"];
diff --git a/htdocs/scielologofi.php b/htdocs/scielologofi.php
index 4cce54825..7033566cf 100644
--- a/htdocs/scielologofi.php
+++ b/htdocs/scielologofi.php
@@ -2,7 +2,7 @@
include ("classScieloLogOfi.php");
// Create new Scielo object
- $host = $HTTP_HOST;
+ $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
$scielo = new ScieloLog ($host);
$scielo->SetPreferedMethod ("POST");
diff --git a/htdocs/security.php b/htdocs/security.php
new file mode 100644
index 000000000..55947e83b
--- /dev/null
+++ b/htdocs/security.php
@@ -0,0 +1,133 @@
+ $itemValue) {
+ $clean[$itemKey] = scielo_audit_sanitize($itemValue, $itemKey);
+ }
+ return $clean;
+ }
+
+ if (is_string($value)) {
+ return substr($value, 0, 200);
+ }
+
+ if (is_scalar($value) || $value === null) {
+ return $value;
+ }
+
+ return gettype($value);
+}
+
+function scielo_audit_event($action, $result, $resource, $resourceId = null, $extra = array())
+{
+ $ipAddress = isset($_SERVER['REMOTE_ADDR'])
+ && filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP)
+ ? $_SERVER['REMOTE_ADDR']
+ : null;
+
+ $sessionId = null;
+ if (function_exists('session_status') && session_status() === PHP_SESSION_ACTIVE) {
+ $rawSessionId = session_id();
+ if ($rawSessionId !== '') {
+ $sessionId = hash('sha256', $rawSessionId);
+ }
+ }
+
+ $entry = array(
+ 'timestamp' => gmdate('c'),
+ 'user_id' => null,
+ 'ip_address' => $ipAddress,
+ 'session_id' => $sessionId,
+ 'action' => (string) $action,
+ 'resource' => (string) $resource,
+ 'resource_id' => $resourceId === null ? null : substr((string) $resourceId, 0, 128),
+ 'result' => (string) $result,
+ 'extra' => scielo_audit_sanitize($extra),
+ );
+
+ error_log(json_encode($entry, JSON_UNESCAPED_SLASHES));
+}
+
+function scielo_is_loopback_request()
+{
+ $remoteAddress = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
+ return in_array($remoteAddress, array('127.0.0.1', '::1'), true);
+}
+
+function scielo_diagnostics_allowed()
+{
+ if (getenv('SCIELO_ENABLE_DIAGNOSTICS') !== '1') {
+ return false;
+ }
+
+ return scielo_is_loopback_request();
+}
+
+function scielo_diagnostic_mode_allowed($mode)
+{
+ if (strtoupper((string) $mode) === 'XML') {
+ return scielo_is_loopback_request();
+ }
+
+ return scielo_diagnostics_allowed();
+}
+
+function scielo_validate_internal_host($host)
+{
+ if (!is_string($host) || strlen($host) > 253) {
+ return false;
+ }
+
+ if (!preg_match('/^([A-Za-z0-9][A-Za-z0-9.-]*)(?::([0-9]{1,5}))?$/', $host, $matches)) {
+ return false;
+ }
+
+ if (strpos($matches[1], '..') !== false) {
+ return false;
+ }
+
+ if (isset($matches[2])) {
+ $port = (int) $matches[2];
+ if ($port < 1 || $port > 65535) {
+ return false;
+ }
+ }
+
+ return $host;
+}
+
+function scielo_internal_host_from_config($config)
+{
+ if (!is_array($config)
+ || !isset($config['SCIELO'])
+ || !isset($config['SCIELO']['SERVER_SCIELO'])) {
+ throw new RuntimeException('SERVER_SCIELO is not configured');
+ }
+
+ $host = scielo_validate_internal_host(trim($config['SCIELO']['SERVER_SCIELO']));
+ if ($host === false) {
+ throw new RuntimeException('SERVER_SCIELO has an invalid format');
+ }
+
+ return $host;
+}
diff --git a/tests/security_regression.php b/tests/security_regression.php
new file mode 100644
index 000000000..b46d05231
--- /dev/null
+++ b/tests/security_regression.php
@@ -0,0 +1,65 @@
+ '/attacker', 'SCIELO_TEST_GLOBAL' => 'attacker');
+$_POST = array();
+$_COOKIE = array();
+$_SERVER['REQUEST_URI'] = '/trusted';
+require(__DIR__ . '/../htdocs/old2new.inc');
+
+assert_true(!isset($GLOBALS['SCIELO_TEST_GLOBAL']), 'request keys must not be copied to GLOBALS');
+assert_true($_SERVER['REQUEST_URI'] === '/trusted', 'request data must not overwrite SERVER values');
+assert_true(isset($GLOBALS['HTTP_GET_VARS']), 'legacy request array alias should remain available');
+
+$config = array('SCIELO' => array('SERVER_SCIELO' => '127.0.0.1:8080'));
+assert_true(scielo_internal_host_from_config($config) === '127.0.0.1:8080', 'configured internal host should be returned');
+assert_true(scielo_audit_sanitize('secret-value', 'password') === '***', 'sensitive audit fields must be redacted');
+
+$old2newSource = file_get_contents(__DIR__ . '/../htdocs/old2new.inc');
+$exportSource = file_get_contents(__DIR__ . '/../htdocs/export.php');
+$articlePageSource = file_get_contents(__DIR__ . '/../htdocs/applications/scielo-org/pages/services/articleRequestGraphicPage.php');
+$sendMailSource = file_get_contents(__DIR__ . '/../htdocs/applications/scielo-org/pages/services/sendMail.php');
+$rssSource = file_get_contents(__DIR__ . '/../htdocs/rss.php');
+$clinicalTrialsSource = file_get_contents(__DIR__ . '/../htdocs/scieloOrg/php/clinicaltrials.php');
+$projectFapespSource = file_get_contents(__DIR__ . '/../htdocs/scieloOrg/php/projfapesp.php');
+
+assert_true(strpos($old2newSource, '$GLOBALS[$key]') === false, 'old2new must not export arbitrary request keys');
+assert_true(strpos($exportSource, "\$_SERVER['HTTP_HOST']") === false, 'export must not use the request Host as backend destination');
+assert_true(strpos($articlePageSource, 'new ArticleService($requestedCaller)') === false, 'article statistics must not use the requested caller as a host');
+assert_true(strpos($sendMailSource, 'new ArticleService($requestedCaller)') === false, 'send mail must not use the requested caller as a host');
+assert_true(strpos($rssSource, "\$_SERVER['HTTP_HOST']") === false, 'RSS backends must not use the request Host');
+assert_true(strpos($clinicalTrialsSource, "\$_SERVER['HTTP_HOST']") === false, 'clinical trials backend must not use the request Host');
+assert_true(strpos($projectFapespSource, "\$_SERVER['HTTP_HOST']") === false, 'FAPESP project backend must not use the request Host');
+
+fwrite(STDOUT, "Security regression tests passed" . PHP_EOL);
|