Untrusted host causes a 500 error from nyholm/psr7

[pavlakis]

When installing sentry using the PSR-7 bridge with the nyholm/psr7 package, I get the following error when testing against an invalid host:

<!-- Unable to parse URI: https:/// (500 Internal Server Error) -->%

The above error is coming from the nyholm/psr7 URI class as it is trying to pass an invalid URI and throws an exception.

Symfony should just raise the SuspiciousOperationException and return a 400 error - which it does without Sentry installed - but with the above configuration always returns a 500.

On a similar setup with sentry/sentry-symfony:^3.5.3 I can't reproduce this issue.

Is there some configuration I am missing?

Versions:

Symfony 4.4.19

sentry/sdk                         3.1.0
sentry/sentry                    3.2.0
sentry/sentry-symfony    4.0.3

---

I have created an empty Symfony 4.4 project as an example: https://github.com/pavlakis/symfony-4.4-sentry/blob/main/README.md

[Jean85]

I've tried using your reproducer but it doesn't work for me.

I've added this simple test:

<?php

namespace App\Tests;

use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;

class ReproductionTest extends WebTestCase
{
    public function test(): void
    {
        $client = self::createClient();
        $client->catchExceptions(false);
        
        $client->request('GET', '/', [], [], ['HTTP_HOST' => 'evil.com']);
    }
}

And I get an error because no route is configured.
I've then added this controller:

<?php

namespace App\Controller;

use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;

class Controller
{
    /**
     * @Route(path="/")
     */
    public function test(): Response
    {
        return new Response();
    }
}

And the test passes. I've also tried using a webserver directly with:

php -S 0.0.0.0:8000 -t public

And I get a 200 with an empty page as expected.

[pavlakis]

@Jean85
Thank you for adding the test. I've updated the example repo accordingly.

I can't explain why the test passes. When I do a curl call I still get a 500.

This always returns a 500 for me when trusted_hosts is set to TRUSTED_HOSTS='^(localhost|127.0.0.1)$'

Using the local webserver :

 php -S 0.0.0.0:8000 -t public
 curl -i -H "Host: evil.com" -X GET http://127.0.0.1:8000/

I can see the following error in the logs:

Uncaught Exception: Unable to parse URI: http:/// 

[Jean85]

Ok now it makes more sense: the tests are excluding something security-wise, so what's happening is that it all stems from the interception of the request here:

sentry-symfony/src/Integration/RequestFetcher.php

Line 59 in 32fce0e

return $this->httpMessageFactory->createRequest($request);

The Symfony request is intercepted and passed through the Symfony-to-PSR-7 bridge, where it gets translated to be later passed to the base Sentry SDK to enrich the event. The URI is coming from Request::prepareBaseUrl(), which probably does some cleanup, hence resulting in an empty host.

As a workaround, you can disable the RequestIntegration from the base SDK to skip this step.

As for a permanent solution, I don't know how to proceed... Maybe we should wrap it in a try and add a breadcrumb to mark the failure?

[ste93cry]

Wrapping the statement into a try/catch and doing nothing if an exception is thrown looks reasonable to me, about the breadcrumb I'm not sure, I don't see any cons in adding it but it's not something we usually do in case an error occurs