1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace Oc\GeoCache\Controller; |
4
|
|
|
|
5
|
|
|
use Oc\GeoCache\Persistence\GeoCache\GeoCacheEntity; |
6
|
|
|
use Oc\GeoCache\Persistence\GeoCache\GeoCacheService; |
7
|
|
|
use Oc\GeoCache\Util; |
8
|
|
|
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route; |
9
|
|
|
use Symfony\Bundle\FrameworkBundle\Controller\Controller; |
10
|
|
|
use Symfony\Component\HttpFoundation\Request; |
11
|
|
|
|
12
|
|
|
class GeoCacheFileController extends Controller |
13
|
|
|
{ |
14
|
|
|
/** |
15
|
|
|
* @var GeoCacheService |
16
|
|
|
*/ |
17
|
|
|
private $geoCacheService; |
18
|
|
|
|
19
|
|
|
/** |
20
|
|
|
* @var Util |
21
|
|
|
*/ |
22
|
|
|
private $geoCacheUtil; |
23
|
|
|
|
24
|
|
|
public function __construct(GeoCacheService $geoCacheService, Util $geoCacheUtil) |
25
|
|
|
{ |
26
|
|
|
$this->geoCacheService = $geoCacheService; |
27
|
|
|
$this->geoCacheUtil = $geoCacheUtil; |
28
|
|
|
} |
29
|
|
|
|
30
|
|
|
/** |
31
|
|
|
* @param Request $request |
32
|
|
|
* @Route("/api/geocache/qrCodes") |
33
|
|
|
*/ |
34
|
|
|
public function generateQrCode(Request $request): void |
35
|
|
|
{ |
36
|
|
|
$waypoint = $request->get('wp'); |
37
|
|
|
$geoCache = $this->geoCacheService->fetchByWaypoint($waypoint); |
38
|
|
|
|
39
|
|
|
if (!$geoCache instanceof GeoCacheEntity) { |
40
|
|
|
throw new \InvalidArgumentException('the waypoint is not valid!'); |
41
|
|
|
} |
42
|
|
|
|
43
|
|
|
header('Content-Type: image/png'); |
44
|
|
|
|
45
|
|
|
if ($request->get('download')) { |
46
|
|
|
header('Content-Disposition: attachment; filename="' . $waypoint . '.png"'); |
|
|
|
|
47
|
|
|
} |
48
|
|
|
|
49
|
|
|
$this->geoCacheUtil->generateQrCodeFromString('https://www.opencaching.de/' . $geoCache->wpOc); |
50
|
|
|
} |
51
|
|
|
|
52
|
|
|
/** |
53
|
|
|
* @param Request $request |
54
|
|
|
* @Route("/api/geocache/qrCodes/ics") |
55
|
|
|
*/ |
56
|
|
|
public function generateQrCodeIcs(Request $request): void |
57
|
|
|
{ |
58
|
|
|
$waypoint = $request->get('wp'); |
59
|
|
|
$geoCache = $this->geoCacheService->fetchByWaypoint($waypoint); |
60
|
|
|
|
61
|
|
|
if (!$geoCache instanceof GeoCacheEntity && $geoCache->type !== 6) { |
62
|
|
|
throw new \InvalidArgumentException('the waypoint is not valid or not an event!'); |
63
|
|
|
} |
64
|
|
|
|
65
|
|
|
$icsString = $this->geoCacheUtil->generateIcsStringFromGeoCache($geoCache); |
|
|
|
|
66
|
|
|
|
67
|
|
|
if ($request->get('download')) { |
68
|
|
|
header('Content-Type: text/calendar; charset=utf-8'); |
69
|
|
|
header('Content-Disposition: attachment; filename="' . $geoCache->wpOc . '.ics"'); |
70
|
|
|
|
71
|
|
|
echo $icsString; |
72
|
|
|
die(); |
73
|
|
|
} |
74
|
|
|
|
75
|
|
|
header('Content-Type: image/png'); |
76
|
|
|
$this->geoCacheUtil->generateQrCodeFromString($icsString); |
77
|
|
|
} |
78
|
|
|
} |
79
|
|
|
|
'Content-Disposition: at...' . $waypoint . '.png"'
can contain request data and is used in response header context(s) leading to a potential security vulnerability.1 path for user data to reach this point
$waypoint
is assignedin htdocs/src/Oc/GeoCache/Controller/GeoCacheFileController.php on line 36
Response Splitting Attacks
Allowing an attacker to set a response header, opens your application to response splitting attacks; effectively allowing an attacker to send any response, he would like.
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: