zf1-future icon indicating copy to clipboard operation
zf1-future copied to clipboard

SUPEE-7405 from Magento 1.9.3.0 - Hostname Validation

Open sreichel opened this issue 2 years ago • 7 comments

The Zend_Validate_Hostname validation was updated to add a DNS check of the A record for the domain.

sreichel avatar Jan 19 '23 04:01 sreichel

@sreichel could you make that conditional? This should not be by default for sure.

develart-projects avatar Aug 09 '23 10:08 develart-projects

@develart-projects i'm stuck. Is it me, or the tests? localhost.localdomain is valid when falling back to checkdnsrr() , not?

sreichel avatar Jan 26 '24 21:01 sreichel

@develart-projects i'm stuck. Is it me, or the tests? localhost.localdomain is valid when falling back to checkdnsrr() , not?

checkdnsrr() does a DNS lookup. While the domain in the test suite is syntactically valid, it is not an actual hostname reachable by the test runner, so it fails.

boenrobot avatar Jan 27 '24 05:01 boenrobot

  1. Zend_Validate_HostnameTest::testBasic localhost.localdomain Failed asserting that true matches expected false.

Need some advice how to fix it.

sreichel avatar Feb 02 '24 15:02 sreichel

  1. Zend_Validate_HostnameTest::testBasic localhost.localdomain Failed asserting that true matches expected false.

Need some advice how to fix it.

Add an option. Default to not using it. When not using it, don't do your whole thing.

The current behavior, as is, already works for all syntactically valid hostnames. It's just that it accepts names that don't exist, which may or may not be what you need.

boenrobot avatar Feb 02 '24 16:02 boenrobot

Add an option.

How should it look like? I cant change the isValid() methods signature (adding a parameter).

Add a new constant to turn it on/off?

sreichel avatar Feb 03 '24 04:02 sreichel

imo you need to test both cases. Old one and your new update, so run 2 different tests for 2 different use cases. I think you can simply feed some common domain, like google.com for testing.

develart-projects avatar Feb 04 '24 20:02 develart-projects