InvalidArgumentException in url.class.php because FILTER_VALIDATE_URL can't handle non-Ascii characters

Description

Hi,

I can see folowing errors in log

Uncaught Exception error: Uncaught exception 'InvalidArgumentException' with message 'Invalid URL: https://www.rogo.cz/users/details.php?search_surname=Majeský&search_username=&student_id=&moduleID=&module=2007&calendar_year=%&students=on&submit=Search&userID=20275&email=&tmp_surname=&tmp_courseID=&tmp_yearID=' in /var/www/rogo/classes/url.class.php:63 Stack trace: #3 {main} thrown in /var/www/rogo/classes/url.class.php on line 63

$_SERVER['QUERY_STRING'] search_surname=Majeský&search_username=&student_id=&moduleID=&module=2007&calendar_year=%&students=on&submit=Search&userID=20275&email=&tmp_surname=&tmp_courseID=&tmp_yearID=
$_POST
$_SERVER['PHP_SELF'] /users/details.php
$_SERVER['REQUEST_METHOD'] GET

Backtrace:
#0 /var/www/rogo/classes/url.class.php(94): Url->__construct('https://www.rog...') #1 /var/www/rogo/include/staff_auth.inc(41): Url::fromGlobals() #2 /var/www/rogo/users/details.php(30): require_once('/var/www/rogo/i...') #3 {main}
--------------------

I suppose it's because FILTER_VALIDATE_URL can't handle non-Ascii characters.

Steps to reproduce

Assumptions

  • There is a user with a surname that contains a non-ASCII character (for example: Majeský)

Steps

  1. Navigate to the user search page

  2. Enter the surname of a user that includes a non-ASCII character and search for them

  3. Double click the user to open their profile

Outcome

The page will generate an exception about the page url being invalid

Expected outcome

The page opens without error.

Notes

This error could also happen on any staff only page where the query string contains a non-ASCII character.

Environment

None

Activity

Show:

Peter Farmer September 9, 2021 at 12:51 PM
Edited

Testing Passed - unable to reproduce original error and further testing as per tests case

Neill Magill July 29, 2021 at 12:17 PM

I made a change so that this error should stop happening. The query part of the URL will no longer go through FILTER_VALIDATE_URL checks.

Neill Magill July 22, 2021 at 7:08 AM

Looking at the stack trace it will happen on any page that uses include/staff_auth.inc and a value passed by get is not ASCII (or indeed the domain didn’t use ASCII)

Josef Martinak July 20, 2021 at 8:24 AM

I’m sorry, I’ve just found it in the log .. I don’t know if it has some significant impact.
I’m waiting for an answer from the user. I’ll let you know.

Joseph Baxter July 20, 2021 at 7:59 AM

do you know what steps you took that generated the error?

so we can try to replicate

Done

Details

Assignee

Reporter

Priority

Affects versions

Fix versions

Impact

Moderate

Likelihood

Unlikely

Category

Service Incident

Components

Original estimate

Time tracking

2h logged

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs
Created July 16, 2021 at 5:51 AM
Updated October 27, 2021 at 3:22 PM
Resolved October 27, 2021 at 3:22 PM
Loading...