Skip to content

Commit c8c4a97

Browse files
author
Maksym Aposov
committed
MAGETWO-41964: Log created on random requests - leads to DoS attack
1 parent b43a7c4 commit c8c4a97

File tree

5 files changed

+120
-21
lines changed

5 files changed

+120
-21
lines changed

‎app/code/Magento/Store/App/Request/PathInfoProcessor.php

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,21 @@
55
*/
66
namespace Magento\Store\App\Request;
77

8+
use Magento\Framework\Exception\NoSuchEntityException;
9+
810
class PathInfoProcessor implements \Magento\Framework\App\Request\PathInfoProcessorInterface
911
{
1012
/**
1113
* @var \Magento\Store\Model\StoreManagerInterface
1214
*/
13-
private $_storeManager;
15+
private $storeManager;
1416

1517
/**
1618
* @param \Magento\Store\Model\StoreManagerInterface $storeManager
1719
*/
1820
public function __construct(\Magento\Store\Model\StoreManagerInterface $storeManager)
1921
{
20-
$this->_storeManager = $storeManager;
22+
$this->storeManager = $storeManager;
2123
}
2224

2325
/**
@@ -33,14 +35,15 @@ public function process(\Magento\Framework\App\RequestInterface $request, $pathI
3335
$storeCode = $pathParts[0];
3436

3537
try {
36-
$store = $this->_storeManager->getStore($storeCode);
37-
} catch (\InvalidArgumentException $e) { // TODO: MAGETWO-39826 Need to replace on NoSuchEntityException
38+
/** @var \Magento\Store\Api\Data\StoreInterface $store */
39+
$store = $this->storeManager->getStore($storeCode);
40+
} catch (NoSuchEntityException $e) {
3841
return $pathInfo;
3942
}
4043

4144
if ($store->isUseStoreInUrl()) {
4245
if (!$request->isDirectAccessFrontendName($storeCode)) {
43-
$this->_storeManager->setCurrentStore($storeCode);
46+
$this->storeManager->setCurrentStore($storeCode);
4447
$pathInfo = '/' . (isset($pathParts[1]) ? $pathParts[1] : '');
4548
return $pathInfo;
4649
} elseif (!empty($storeCode)) {

‎app/code/Magento/Store/Model/StoreRepository.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,7 @@ public function get($code)
5757
$store = $this->storeFactory->create();
5858
$store->load($code, 'code');
5959
if ($store->getId() === null) {
60-
// TODO: MAGETWO-39826 Need to replace on NoSuchEntityException
61-
throw new \InvalidArgumentException();
60+
throw new NoSuchEntityException();
6261
}
6362
$this->entities[$code] = $store;
6463
$this->entitiesById[$store->getId()] = $store;

‎app/code/Magento/Store/Model/StoreResolver.php

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -137,14 +137,9 @@ protected function getRequestedStoreByCode($storeCode)
137137
try {
138138
$store = $this->storeRepository->getActiveStoreByCode($storeCode);
139139
} catch (StoreIsInactiveException $e) {
140-
$error = __('Requested store is inactive');
141-
} catch (\InvalidArgumentException $e) { // TODO: MAGETWO-39826 Need to replace on NoSuchEntityException
142-
$error = __('Requested store is not found');
140+
throw new NoSuchEntityException(__('Requested store is inactive'));
143141
}
144142

145-
if (isset($error, $e)) {
146-
throw new NoSuchEntityException($error, $e);
147-
}
148143
return $store;
149144
}
150145

@@ -160,14 +155,9 @@ protected function getDefaultStoreById($id)
160155
try {
161156
$store = $this->storeRepository->getActiveStoreById($id);
162157
} catch (StoreIsInactiveException $e) {
163-
$error = __('Default store is inactive');
164-
} catch (\InvalidArgumentException $e) { // TODO: MAGETWO-39826 Need to replace on NoSuchEntityException
165-
$error = __('Default store is not found');
158+
throw new NoSuchEntityException(__('Default store is inactive'));
166159
}
167160

168-
if (isset($error, $e)) {
169-
throw new NoSuchEntityException($error, $e);
170-
}
171161
return $store;
172162
}
173163
}

‎app/code/Magento/Store/Test/Unit/App/Request/PathInfoProcessorTest.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
*/
66
namespace Magento\Store\Test\Unit\App\Request;
77

8+
use Magento\Framework\Exception\NoSuchEntityException;
9+
810
class PathInfoProcessorTest extends \PHPUnit_Framework_TestCase
911
{
1012
/**
@@ -112,8 +114,7 @@ public function testProcessIfStoreCodeIsNotExist()
112114
{
113115
$store = $this->getMock('\Magento\Store\Model\Store', [], [], '', false);
114116
$this->_storeManagerMock->expects($this->once())->method('getStore')->with('storeCode')
115-
// TODO: MAGETWO-39826 Need to replace on NoSuchEntityException
116-
->willThrowException(new \InvalidArgumentException());
117+
->willThrowException(new NoSuchEntityException());
117118
$store->expects($this->never())->method('isUseStoreInUrl');
118119
$this->_requestMock->expects($this->never())->method('isDirectAccessFrontendName');
119120

‎dev/tests/integration/testsuite/Magento/Store/App/Request/PathInfoProcessorTest.php

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
<?php
2+
/**
3+
* Copyright © 2015 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Store\App\Request;
7+
8+
use \Magento\TestFramework\Helper\Bootstrap;
9+
use \Magento\Store\Model\ScopeInterface;
10+
use \Magento\Store\Model\Store;
11+
12+
class PathInfoProcessorTest extends \PHPUnit_Framework_TestCase
13+
{
14+
/**
15+
* @var \Magento\Store\App\Request\PathInfoProcessor
16+
*/
17+
protected $pathProcessor;
18+
19+
protected function setUp()
20+
{
21+
$this->pathProcessor = Bootstrap::getObjectManager()->create('Magento\Store\App\Request\PathInfoProcessor');
22+
}
23+
24+
/**
25+
* @covers \Magento\Store\App\Request\PathInfoProcessor::process
26+
* @dataProvider notValidStoreCodeDataProvider
27+
*/
28+
public function testProcessNotValidStoreCode($pathInfo)
29+
{
30+
/** @var \Magento\Framework\App\RequestInterface $request */
31+
$request = Bootstrap::getObjectManager()->create('Magento\Framework\App\RequestInterface');
32+
$this->assertEquals($pathInfo, $this->pathProcessor->process($request, $pathInfo));
33+
}
34+
35+
public function notValidStoreCodeDataProvider()
36+
{
37+
return [
38+
['not_valid_store_code_int' => '/100500/m/c/a'],
39+
['not_valid_store_code_str' => '/test_string/m/c/a'],
40+
];
41+
}
42+
43+
/**
44+
* @covers \Magento\Store\App\Request\PathInfoProcessor::process
45+
* @magentoDataFixture Magento/Store/_files/core_fixturestore.php
46+
*/
47+
public function testProcessValidStoreCodeCase1()
48+
{
49+
/** @var \Magento\Store\Model\Store $store */
50+
$store = Bootstrap::getObjectManager()->get('Magento\Store\Model\Store');
51+
$store->load('fixturestore', 'code');
52+
53+
/** @var \Magento\Framework\App\RequestInterface $request */
54+
$request = Bootstrap::getObjectManager()->create('Magento\Framework\App\RequestInterface');
55+
56+
/** @var \Magento\Framework\App\Config\ReinitableConfigInterface $config */
57+
$config = Bootstrap::getObjectManager()->get('\Magento\Framework\App\Config\ReinitableConfigInterface');
58+
$config->setValue(Store::XML_PATH_STORE_IN_URL, false, ScopeInterface::SCOPE_STORE, $store->getCode());
59+
$pathInfo = sprintf('/%s/m/c/a', $store->getCode());
60+
$this->assertEquals($pathInfo, $this->pathProcessor->process($request, $pathInfo));
61+
}
62+
63+
/**
64+
* @covers \Magento\Store\App\Request\PathInfoProcessor::process
65+
* @magentoDataFixture Magento/Store/_files/core_fixturestore.php
66+
*/
67+
public function testProcessValidStoreCodeCase2()
68+
{
69+
/** @var \Magento\Store\Model\Store $store */
70+
$store = Bootstrap::getObjectManager()->get('Magento\Store\Model\Store');
71+
$store->load('fixturestore', 'code');
72+
73+
/** @var \Magento\Framework\App\RequestInterface $request */
74+
$request = Bootstrap::getObjectManager()->create('Magento\Framework\App\RequestInterface');
75+
76+
/** @var \Magento\Framework\App\Config\ReinitableConfigInterface $config */
77+
$config = Bootstrap::getObjectManager()->get('\Magento\Framework\App\Config\ReinitableConfigInterface');
78+
$config->setValue(Store::XML_PATH_STORE_IN_URL, true, ScopeInterface::SCOPE_STORE, $store->getCode());
79+
$pathInfo = sprintf('/%s/m/c/a', $store->getCode());
80+
$this->assertEquals('/m/c/a', $this->pathProcessor->process($request, $pathInfo));
81+
}
82+
83+
/**
84+
* @covers \Magento\Store\App\Request\PathInfoProcessor::process
85+
* @magentoDataFixture Magento/Store/_files/core_fixturestore.php
86+
*/
87+
public function testProcessValidStoreCodeCase3()
88+
{
89+
/** @var \Magento\Store\Model\Store $store */
90+
$store = Bootstrap::getObjectManager()->get('Magento\Store\Model\Store');
91+
$store->load('fixturestore', 'code');
92+
93+
/** @var \Magento\Framework\App\RequestInterface $request */
94+
$request = Bootstrap::getObjectManager()->create(
95+
'Magento\Framework\App\RequestInterface',
96+
['directFrontNames' => [$store->getCode() => true]]
97+
);
98+
99+
/** @var \Magento\Framework\App\Config\ReinitableConfigInterface $config */
100+
$config = Bootstrap::getObjectManager()->get('\Magento\Framework\App\Config\ReinitableConfigInterface');
101+
$config->setValue(Store::XML_PATH_STORE_IN_URL, true, ScopeInterface::SCOPE_STORE, $store->getCode());
102+
$pathInfo = sprintf('/%s/m/c/a', $store->getCode());
103+
$this->assertEquals($pathInfo, $this->pathProcessor->process($request, $pathInfo));
104+
$this->assertEquals('noroute', $request->getActionName());
105+
}
106+
}

0 commit comments

Comments
 (0)