redirect_goto leads to the blank page always if some of the status codes here redirect_status_code_options() is translated not correctly.

Source of the issue is: drupal_add_http_header('Status', redirect_status_code_options($redirect->status_code));

As in redirect_status_code_options() statuses are wrapped in t(), it can be a reason of vulnerability.

Status header should be started always with the number like "301 ...", if someone translates locale string for example "301 Moved Permanently" like "Content is moved (301)", redirects become to be broken for whole site.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

anton.shloma created an issue. See original summary.

anton.shloma’s picture

anton.shloma’s picture

anton.shloma’s picture

Status: Active » Needs review

The last submitted patch, 2: redirect.status-codes-issue.2820766.patch, failed testing.

The last submitted patch, 2: redirect.status-codes-issue.2820766.patch, failed testing.

Stevel’s picture

Status: Needs review » Reviewed & tested by the community

Yes, this looks good indeed. The actual status code number should not be passed to translators.

pifagor’s picture

alex_optim’s picture

Looks good.

pifagor’s picture

pifagor’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

ciss’s picture

Isn't the real issue here that the translated string is used in the status header?

ciss’s picture

... Well, the good news is that header injections are prevented by PHP:

Warning: Header may not contain more than a single header, new line detected in drupal_send_headers() (line 1499 of /var/www/html.original/includes/bootstrap.inc).