php中parse_url函数的源码及分析

前言

看师傅们的文章时发现,parse_url出现的次数较多，单纯parse_url解析漏洞的考题也有很多，在此研究一下源码(太菜了看不懂，待日后再补充Orz)

源码

PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
{
    char port_buf[6];
    php_url *ret = ecalloc(1, sizeof(php_url));
    char const *s, *e, *p, *pp, *ue;

    s = str;
    ue = s + length;

    /* parse scheme */
    if ((e = memchr(s, ':', length)) && e != s) {
        /* validate scheme */
        p = s;
        while (p < e) {
            /* scheme = 1*[ lowalpha | digit | "+" | "-" | "." ] */
            if (!isalpha(*p) && !isdigit(*p) && *p != '+' && *p != '.' && *p != '-') {
                if (e + 1 < ue && e < s + strcspn(s, "?#")) {
                    goto parse_port;
                } else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
                    s += 2;
                    e = 0;
                    goto parse_host;
                } else {
                    goto just_path;
                }
            }
            p++;
        }

        if (e + 1 == ue) { /* only scheme is available */
            ret->scheme = estrndup(s, (e - s));
            php_replace_controlchars_ex(ret->scheme, (e - s));
            return ret;
        }

        /*
         * certain schemas like mailto: and zlib: may not have any / after them
         * this check ensures we support those.
         */
        if (*(e+1) != '/') {
            /* check if the data we get is a port this allows us to
             * correctly parse things like a.com:80
             */
            p = e + 1;
            while (p < ue && isdigit(*p)) {
                p++;
            }

            if ((p == ue || *p == '/') && (p - e) < 7) {
                goto parse_port;
            }

            ret->scheme = estrndup(s, (e-s));
            php_replace_controlchars_ex(ret->scheme, (e - s));

            s = e + 1;
            goto just_path;
        } else {
            ret->scheme = estrndup(s, (e-s));
            php_replace_controlchars_ex(ret->scheme, (e - s));

            if (e + 2 < ue && *(e + 2) == '/') {
                s = e + 3;
                if (!strncasecmp("file", ret->scheme, sizeof("file"))) {
                    if (e + 3 < ue && *(e + 3) == '/') {
                        /* support windows drive letters as in:
                           file:///c:/somedir/file.txt
                        */
                        if (e + 5 < ue && *(e + 5) == ':') {
                            s = e + 4;
                        }
                        goto just_path;
                    }
                }
            } else {
                s = e + 1;
                goto just_path;
            }
        }
    } else if (e) { /* no scheme; starts with colon: look for port */
        parse_port:
        p = e + 1;
        pp = p;

        while (pp < ue && pp - p < 6 && isdigit(*pp)) {
            pp++;
        }

        if (pp - p > 0 && pp - p < 6 && (pp == ue || *pp == '/')) {
            zend_long port;
            memcpy(port_buf, p, (pp - p));
            port_buf[pp - p] = '\0';
            port = ZEND_STRTOL(port_buf, NULL, 10);
            if (port > 0 && port <= 65535) {
                ret->port = (unsigned short) port;
                if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
                    s += 2;
                }
            } else {
                if (ret->scheme) efree(ret->scheme);
                efree(ret);
                return NULL;
            }
        } else if (p == pp && pp == ue) {
            if (ret->scheme) efree(ret->scheme);
            efree(ret);
            return NULL;
        } else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
            s += 2;
        } else {
            goto just_path;
        }
    } else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
        s += 2;
    } else {
        goto just_path;
    }

    parse_host:
    /* Binary-safe strcspn(s, "/?#") */
    e = ue;
    if ((p = memchr(s, '/', e - s))) {
        e = p;
    }
    if ((p = memchr(s, '?', e - s))) {
        e = p;
    }
    if ((p = memchr(s, '#', e - s))) {
        e = p;
    }

    /* check for login and password */
    if ((p = zend_memrchr(s, '@', (e-s)))) {
        if ((pp = memchr(s, ':', (p-s)))) {
            ret->user = estrndup(s, (pp-s));
            php_replace_controlchars_ex(ret->user, (pp - s));

            pp++;
            ret->pass = estrndup(pp, (p-pp));
            php_replace_controlchars_ex(ret->pass, (p-pp));
        } else {
            ret->user = estrndup(s, (p-s));
            php_replace_controlchars_ex(ret->user, (p-s));
        }

        s = p + 1;
    }

    /* check for port */
    if (s < ue && *s == '[' && *(e-1) == ']') {
        /* Short circuit portscan,
           we're dealing with an
           IPv6 embedded address */
        p = NULL;
    } else {
        p = zend_memrchr(s, ':', (e-s));
    }

    if (p) {
        if (!ret->port) {
            p++;
            if (e-p > 5) { /* port cannot be longer then 5 characters */
                if (ret->scheme) efree(ret->scheme);
                if (ret->user) efree(ret->user);
                if (ret->pass) efree(ret->pass);
                efree(ret);
                return NULL;
            } else if (e - p > 0) {
                zend_long port;
                memcpy(port_buf, p, (e - p));
                port_buf[e - p] = '\0';
                port = ZEND_STRTOL(port_buf, NULL, 10);
                if (port > 0 && port <= 65535) {
                    ret->port = (unsigned short)port;
                } else {
                    if (ret->scheme) efree(ret->scheme);
                    if (ret->user) efree(ret->user);
                    if (ret->pass) efree(ret->pass);
                    efree(ret);
                    return NULL;
                }
            }
            p--;
        }
    } else {
        p = e;
    }

    /* check if we have a valid host, if we don't reject the string as url */
    if ((p-s) < 1) {
        if (ret->scheme) efree(ret->scheme);
        if (ret->user) efree(ret->user);
        if (ret->pass) efree(ret->pass);
        efree(ret);
        return NULL;
    }

    ret->host = estrndup(s, (p-s));
    php_replace_controlchars_ex(ret->host, (p - s));

    if (e == ue) {
        return ret;
    }

    s = e;

    just_path:

    e = ue;
    p = memchr(s, '#', (e - s));
    if (p) {
        p++;
        if (p < e) {
            ret->fragment = estrndup(p, (e - p));
            php_replace_controlchars_ex(ret->fragment, (e - p));
        }
        e = p-1;
    }

    p = memchr(s, '?', (e - s));
    if (p) {
        p++;
        if (p < e) {
            ret->query = estrndup(p, (e - p));
            php_replace_controlchars_ex(ret->query, (e - p));
        }
        e = p-1;
    }

    if (s < e || s == ue) {
        ret->path = estrndup(s, (e - s));
        php_replace_controlchars_ex(ret->path, (e - s));
    }

    return ret;
}

/* {{{ proto mixed parse_url(string url, [int url_component])
   Parse a URL and return its components */
PHP_FUNCTION(parse_url)
{
    char *str;
    size_t str_len;
    php_url *resource;
    zend_long key = -1;

    if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &str, &str_len, &key) == FAILURE) {
        return;
    }

    resource = php_url_parse_ex(str, str_len);
    if (resource == NULL) {
        /* @todo Find a method to determine why php_url_parse_ex() failed */
        RETURN_FALSE;
}

分析

1. 只要请求的url里不含有冒号(:)就会被当成path解析