Bug #76566 [NEW]: curl fails to connect to the right host

From: a dot nadelle92 at gmail dot com Operating system: Irrelevant PHP version: 7.1Git-2018-07-02 (Git) Package: HTTP related Bug Type: Bug Bug description:curl fails to connect to the right host Description: ------------ Hi, When putting this link http://jx$(Tqz*Rn9d~@www.example.com:+@www.google.com to parse_url() function, the host is www.google.com. Nevertheless, when trying to connect with curl it connects to www.example.com . I discovered this bug since I was able to bypass hostname filtering and I could do a Server Side Request Forgery. I tested version 7.1.18, I didn't test the latest one but I do not see a report for such bug. Perhaps, they may be vulnerable the same. Test script: --------------- <?php /** * Get a web file (HTML, XHTML, XML, image, etc.) from a URL. Return an * array containing the HTTP server response header fields and content. */ $url = "http://jx$(Tqz*Rn9d~@www.example.com:+@www.google.com"; var_dump(parse_url($url)); function get_web_page( $url ) { $user_agent='Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0'; $options = array( CURLOPT_CUSTOMREQUEST => "GET", //set request type post or get CURLOPT_POST => false, //set to GET CURLOPT_USERAGENT => $user_agent, //set user agent CURLOPT_RETURNTRANSFER => true, // return web page CURLOPT_HEADER => false, // don't return headers CURLOPT_FOLLOWLOCATION => true, // follow redirects CURLOPT_ENCODING => "", // handle all encodings CURLOPT_AUTOREFERER => false, // set referer on redirect CURLOPT_CONNECTTIMEOUT => 120, // timeout on connect CURLOPT_TIMEOUT => 120, // timeout on response CURLOPT_MAXREDIRS => 2, // stop after 10 redirects CURLOPT_HTTPHEADER => array("Cookie: ".base64_decode($_REQUEST['cookie'])) ); $ch = curl_init( $url ); curl_setopt_array( $ch, $options ); $content = curl_exec( $ch ); $err = curl_errno( $ch ); $errmsg = curl_error( $ch ); $header = curl_getinfo( $ch ); curl_close( $ch ); $header['errno'] = $err; $header['errmsg'] = $errmsg; $header['content'] = $content; return $header; } $result = get_web_page( $url ); if ( $result['errno'] != 0 ) { echo "strange_error ".$result['errno']; } if ( $result['http_code'] == 200 ) { echo $result['content']; } else { echo $result['http_code']; } ?> Expected result: ---------------- curl connecting to the same host as parse_url() function Actual result: -------------- curl is not connecting to the same host as parse_url() function -- Edit bug report at https://bugs.php.net/bug.php?id=76566&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76566&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76566&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76566&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76566&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76566&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76566&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76566&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76566&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76566&r=support Expected behavior: https://bugs.php.net/fix.php?id=76566&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76566&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76566&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76566&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76566&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76566&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76566&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76566&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76566&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76566&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76566&r=mysqlcfg