Project

General

Profile

Bug #9023

is_fqdn() validation

Added by Nano Caiordo 6 months ago. Updated 4 months ago.

Status:
New
Priority:
High
Assignee:
-
Category:
-
Target version:
-
Start date:
10/07/2018
Due date:
% Done:

0%

Estimated time:
Affected Version:
Affected Architecture:

Description

Hello,

current validation doesn't follow any RFC guideline and it's pretty much broken.

var_dump(is_fqdn('a!@#$%^&0.b%^a1'));
bool(true)

A patch is ready and I'll generate the push request right after this gets submitted.

is_fqdn.txt (2.61 KB) is_fqdn.txt speed and domain validation comparison file Nano Caiordo, 11/30/2018 03:47 AM

History

#1 Updated by Nano Caiordo 6 months ago

Ulterior information on this patch:

As per php.net/manual/en/filter.filters.validate.php: FILTER_VALIDATE_DOMAIN

Validates domain names against RFC 1034, RFC 1035, RFC 952, RFC 1123, RFC 2732, RFC 2181, and RFC 1123. Optional flag FILTER_FLAG_HOSTNAME adds ability to specifically validate hostnames (they must start with an alphanumberic character and contain only alphanumerics or hyphens).

filter_var() returns false on failure or the entire unmodified input string on success, on this the patch removes any valid trailing dot before counting parts.
Sure the patch could be modified to trim and count on success only.

Above RFCs are pretty old but updated only for domain DNS names, records with underscore, and SMTP mail transport specifications.
This patch will not validate a domain DNS name such as _tcp.example.test, as I suppose is_fqdn() target RFC 1123.

bool(true) 'sub.domain.test.'
bool(true) 'sub.domain.test'
bool(true) 'xn--sub.xn--domain.test'

bool(false) 'domain.test.'
bool(false) 'domain.test'
bool(false) '-sub.domain.test'
bool(false) '_sub.domain.test'
bool(false) 's_ub.domain.test'

#2 Updated by Nano Caiordo 4 months ago

I'm testing via System Patcher since https://github.com/pfsense/pfsense/pull/3998 went into approved/needs testing and so far unbound reloads are quite faster, placebo effect? Could anyone confirm?

As a reference I'm also adding here a speed and domain validation comparison file over thousands of iterations (cannot quite remember the exact number).

Also available in: Atom PDF