ILIAS  release_5-1 Revision 5.0.0-5477-g43f3e3fab5f
Auth_OpenID_TrustRoot Class Reference

A wrapper for trust-root related functions. More...

+ Collaboration diagram for Auth_OpenID_TrustRoot:

Static Public Member Functions

static buildDiscoveryURL ($realm)
 
static _parse ($trust_root)
 Parse a URL into its trust_root parts. More...
 
static isSane ($trust_root)
 Is this trust root sane? More...
 
static match ($trust_root, $url)
 Does this URL match the given trust root? More...
 

Detailed Description

A wrapper for trust-root related functions.

Definition at line 47 of file TrustRoot.php.

Member Function Documentation

◆ _parse()

static Auth_OpenID_TrustRoot::_parse (   $trust_root)
static

Parse a URL into its trust_root parts.

@access private

Parameters
string$trust_rootThe url to parse
Returns
mixed $parsed Either an associative array of trust root parts or false if parsing failed.

Definition at line 94 of file TrustRoot.php.

97 {
98 $trust_root = Auth_OpenID_urinorm($trust_root);
99 if ($trust_root === null) {
100 return false;
101 }
102
103 if (preg_match("/:\/\/[^:]+(:\d+){2,}(\/|$)/", $trust_root)) {
104 return false;
105 }
106
107 $parts = @parse_url($trust_root);
108 if ($parts === false) {
109 return false;
110 }
111
112 $required_parts = array('scheme', 'host');
113 $forbidden_parts = array('user', 'pass', 'fragment');
114 $keys = array_keys($parts);
115 if (array_intersect($keys, $required_parts) != $required_parts) {
116 return false;
117 }
118
119 if (array_intersect($keys, $forbidden_parts) != array()) {
120 return false;
121 }
122
123 if (!preg_match(Auth_OpenID___HostSegmentRe, $parts['host'])) {
124 return false;
125 }
126
127 $scheme = strtolower($parts['scheme']);
128 $allowed_schemes = array('http', 'https');
129 if (!in_array($scheme, $allowed_schemes)) {
130 return false;
131 }
132 $parts['scheme'] = $scheme;
133
134 $host = strtolower($parts['host']);
135 $hostparts = explode('*', $host);
136 switch (count($hostparts)) {
137 case 1:
138 $parts['wildcard'] = false;
139 break;
140 case 2:
141 if ($hostparts[0] ||
142 ($hostparts[1] && substr($hostparts[1], 0, 1) != '.')) {
143 return false;
144 }
145 $host = $hostparts[1];
146 $parts['wildcard'] = true;
147 break;
148 default:
149 return false;
150 }
151 if (strpos($host, ':') !== false) {
152 return false;
153 }
154
155 $parts['host'] = $host;
156
157 if (isset($parts['path'])) {
158 $path = strtolower($parts['path']);
159 if (substr($path, 0, 1) != '/') {
160 return false;
161 }
162 } else {
163 $path = '/';
164 }
165
166 $parts['path'] = $path;
167 if (!isset($parts['port'])) {
168 $parts['port'] = false;
169 }
170
171
172 $parts['unparsed'] = $trust_root;
173
const Auth_OpenID___HostSegmentRe
Definition: TrustRoot.php:42
Auth_OpenID_urinorm($uri)
Definition: URINorm.php:142
$path
Definition: index.php:22

Referenced by Auth_OpenID_returnToMatches(), buildDiscoveryURL(), Auth_OpenID_CheckIDRequest\make(), and Auth_OpenID_CheckIDRequest\trustRootValid().

+ Here is the caller graph for this function:

◆ buildDiscoveryURL()

static Auth_OpenID_TrustRoot::buildDiscoveryURL (   $realm)
static

Definition at line 59 of file TrustRoot.php.

62 {
63 $parsed = Auth_OpenID_TrustRoot::_parse($realm);
64
65 if ($parsed === false) {
66 return false;
67 }
68
69 if ($parsed['wildcard']) {
70 // Use "www." in place of the star
71 if ($parsed['host'][0] != '.') {
72 return false;
73 }
74
75 $www_domain = 'www' . $parsed['host'];
76
77 return sprintf('%s://%s%s', $parsed['scheme'],
78 $www_domain, $parsed['path']);
79 } else {
80 return $parsed['unparsed'];
static _parse($trust_root)
Parse a URL into its trust_root parts.
Definition: TrustRoot.php:94

References _parse().

Referenced by Auth_OpenID_verifyReturnTo().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ isSane()

static Auth_OpenID_TrustRoot::isSane (   $trust_root)
static

Is this trust root sane?

A trust root is sane if it is syntactically valid and it has a reasonable domain name. Specifically, the domain name must be more than one level below a standard TLD or more than two levels below a two-letter tld.

For example, '*.com' is not a sane trust root, but '*.foo.com' is. '*.co.uk' is not sane, but '*.bbc.co.uk' is.

This check is not always correct, but it attempts to err on the side of marking sane trust roots insane instead of marking insane trust roots sane. For example, 'kink.fm' is marked as insane even though it "should" (for some meaning of should) be marked sane.

This function should be used when creating OpenID servers to alert the users of the server when a consumer attempts to get the user to accept a suspicious trust root.

Parameters
string$trust_rootThe trust root to check
Returns
bool $sanity Whether the trust root looks OK

Definition at line 200 of file TrustRoot.php.

203 {
204 $parts = Auth_OpenID_TrustRoot::_parse($trust_root);
205 if ($parts === false) {
206 return false;
207 }
208
209 // Localhost is a special case
210 if ($parts['host'] == 'localhost') {
211 return true;
212 }
213
214 $host_parts = explode('.', $parts['host']);
215 if ($parts['wildcard']) {
216 // Remove the empty string from the beginning of the array
217 array_shift($host_parts);
218 }
219
220 if ($host_parts && !$host_parts[count($host_parts) - 1]) {
221 array_pop($host_parts);
222 }
223
224 if (!$host_parts) {
225 return false;
226 }
227
228 // Don't allow adjacent dots
229 if (in_array('', $host_parts, true)) {
230 return false;
231 }
232
233 // Get the top-level domain of the host. If it is not a valid TLD,
234 // it's not sane.
235 preg_match(Auth_OpenID___TLDs, $parts['host'], $matches);
236 if (!$matches) {
237 return false;
238 }
239 $tld = $matches[1];
240
241 if (count($host_parts) == 1) {
242 return false;
243 }
244
245 if ($parts['wildcard']) {
246 // It's a 2-letter tld with a short second to last segment
247 // so there needs to be more than two segments specified
248 // (e.g. *.co.uk is insane)
249 $second_level = $host_parts[count($host_parts) - 2];
250 if (strlen($tld) == 2 && strlen($second_level) <= 3) {
251 return count($host_parts) > 2;
252 }
253 }
254
const Auth_OpenID___TLDs
A regular expression that matches a domain ending in a top-level domains.
Definition: TrustRoot.php:23

◆ match()

static Auth_OpenID_TrustRoot::match (   $trust_root,
  $url 
)
static

Does this URL match the given trust root?

Return whether the URL falls under the given trust root. This does not check whether the trust root is sane. If the URL or trust root do not parse, this function will return false.

Parameters
string$trust_rootThe trust root to match against
string$urlThe URL to check
Returns
bool $matches Whether the URL matches against the trust root

Definition at line 270 of file TrustRoot.php.

273 {
274 $trust_root_parsed = Auth_OpenID_TrustRoot::_parse($trust_root);
275 $url_parsed = Auth_OpenID_TrustRoot::_parse($url);
276 if (!$trust_root_parsed || !$url_parsed) {
277 return false;
278 }
279
280 // Check hosts matching
281 if ($url_parsed['wildcard']) {
282 return false;
283 }
284 if ($trust_root_parsed['wildcard']) {
285 $host_tail = $trust_root_parsed['host'];
286 $host = $url_parsed['host'];
287 if ($host_tail &&
288 substr($host, -(strlen($host_tail))) != $host_tail &&
289 substr($host_tail, 1) != $host) {
290 return false;
291 }
292 } else {
293 if ($trust_root_parsed['host'] != $url_parsed['host']) {
294 return false;
295 }
296 }
297
298 // Check path and query matching
299 $base_path = $trust_root_parsed['path'];
300 $path = $url_parsed['path'];
301 if (!isset($trust_root_parsed['query'])) {
302 if ($base_path != $path) {
303 if (substr($path, 0, strlen($base_path)) != $base_path) {
304 return false;
305 }
306 if (substr($base_path, strlen($base_path) - 1, 1) != '/' &&
307 substr($path, strlen($base_path), 1) != '/') {
308 return false;
309 }
310 }
311 } else {
312 $base_query = $trust_root_parsed['query'];
313 $query = @$url_parsed['query'];
314 $qplus = substr($query, 0, strlen($base_query) + 1);
315 $bqplus = $base_query . '&';
316 if ($base_path != $path ||
317 ($base_query != $query && $qplus != $bqplus)) {
318 return false;
319 }
320 }
321
322 // The port and scheme need to match exactly
323 return ($trust_root_parsed['scheme'] == $url_parsed['scheme'] &&
$url
Definition: shib_logout.php:72

Referenced by Auth_OpenID_returnToMatches(), and Auth_OpenID_CheckIDRequest\trustRootValid().

+ Here is the caller graph for this function:

The documentation for this class was generated from the following file: