redirect_goto leads to the blank page always if some of the status codes here redirect_status_code_options() is translated not correctly.

Source of the issue is: drupal_add_http_header('Status', redirect_status_code_options($redirect->status_code));

As in redirect_status_code_options() statuses are wrapped in t(), it can be a reason of vulnerability.

Status header should be started always with the number like "301 ...", if someone translates locale string for example "301 Moved Permanently" like "Content is moved (301)", redirects become to be broken for whole site.

CommentFileSizeAuthor
#3 redirect.status-codes-issue.2820766-2.patch852 bytesanton.shloma
#2 redirect.status-codes-issue.2820766.patch1 KBanton.shloma

Comments

anton.shloma created an issue. See original summary.

anton.shloma’s picture

anton.shloma commented
StatusFileSize
new redirect.status-codes-issue.2820766.patch1 KB

Here is simple patch, which fixes this vulnerability.

anton.shloma’s picture

anton.shloma commented
StatusFileSize
new redirect.status-codes-issue.2820766-2.patch852 bytes

Sry, correct patch is attached

anton.shloma’s picture

anton.shloma commented
Status: Active » Needs review

The last submitted patch, 2: redirect.status-codes-issue.2820766.patch, failed testing.

The last submitted patch, 2: redirect.status-codes-issue.2820766.patch, failed testing.

Stevel’s picture

Stevel commented
Status: Needs review » Reviewed & tested by the community

Yes, this looks good indeed. The actual status code number should not be passed to translators.

pifagor’s picture

pifagor commented

RTBC

alex_optim’s picture

alex_optim
Location Tallinn
commented

Looks good.

pifagor’s picture

pifagor commented

pifagor’s picture

pifagor commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

ciss’s picture

ciss commented

Isn't the real issue here that the translated string is used in the status header?

ciss’s picture

ciss commented

... Well, the good news is that header injections are prevented by PHP:

Warning: Header may not contain more than a single header, new line detected in drupal_send_headers() (line 1499 of /var/www/html.original/includes/bootstrap.inc).