Security Advisory: Route constraint bypass >= 4.4.0, <= 4.15.2
A security issue has recently been reported in Slim’s routing component that allows a route parameter constraint to be bypassed via double percent-encoded input.
Slim is a PHP micro framework that helps you quickly write simple yet powerful web applications and APIs.
<?php
use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;
use Slim\Factory\AppFactory;
require __DIR__ . '/../vendor/autoload.php';
$app = AppFactory::create();
$app->get('/hello/{name}', function (Request $request, Response $response, array $args) {
$name = $args['name'];
$response->getBody()->write("Hello, $name");
return $response;
});
$app->run();We recommend you install the Slim Framework with the Composer dependency manager.
The easiest way to start working with Slim is to create a project using Slim-Skeleton as a base by running this bash command:
$ composer create-project slim/slim-skeleton [my-app-name]Replace [my-app-name] with the desired directory name for your new application.
You can then run it with PHP's built-in webserver:
$ cd [my-app-name]; php -S localhost:8080 -t publicSlim provides a fast and powerful router that maps route callbacks to specific HTTP request methods and URIs. It supports parameters and pattern matching.
Build your application with concentric middleware to tweak the HTTP request and response objects around your Slim app.
Slim supports any PSR-7 HTTP message implementation so you may inspect and manipulate HTTP message method, status, URI, headers, cookies, and body.
Slim supports dependency injection so you have complete control of your external tools. Use any PSR-11 ContainerInterface implementation.
A security issue has recently been reported in Slim’s routing component that allows a route parameter constraint to be bypassed via double percent-encoded input.
We have released Slim 4.15.3 today that fixes a route parameter constraint bypass vulnerability in Slim >= 4.0.0, <= 4.15.2 (GHSA-h377-p8x2-prf9). If you are using Slim 4.0.0 or any later version up to 4.15.2 and use route placeholder values without revalidating them, please upgrade to Slim 4.15.3.
A security issue has recently been reported in Slim’s HTML error renderer that could allow reflected cross-site scripting (XSS) attacks in applications that feed untrusted data into HttpException::setTitle() and/or setDescription().
We can be found on Slack at slimphp.slack.com.
Get Access to the Slack Channel
We also have a Discourse forum at discourse.slimframework.com/ for when you have a more in depth question.