5.x Middleware and routing security hardening

Slim/App.php

@@ -17,6 +17,7 @@
 use Psr\Http\Server\RequestHandlerInterface;
 use Psr\Log\LoggerInterface;
 use Slim\Interfaces\EmitterInterface;
+use Slim\Interfaces\RouteInterface;
 use Slim\Interfaces\RouterInterface;
 use Slim\Interfaces\ServerRequestCreatorInterface;
 use Slim\Middleware\EndpointMiddleware;
@@ -106,9 +107,9 @@ public function getContainer(): ContainerInterface
      * @param string $path The URI pattern for the route
      * @param callable|string $handler The route handler callable or controller method
      *
-     * @return Route The newly created route instance
+     * @return RouteInterface The newly created route instance
      */
-    public function map(array $methods, string $path, callable|string $handler): Route
+    public function map(array $methods, string $path, callable|string $handler): RouteInterface
     {
         return $this->router->map($methods, $path, $handler);
     }
@@ -143,7 +144,7 @@ public function setBasePath(string $basePath): self
      */
     public function getBasePath(): string
     {
-        return $this->router->getBasePath();
+        return $this->router->getBasePath() ?? '';
     }
 
     /**

Slim/Exception/HttpMethodNotAllowedException.php

@@ -10,8 +10,6 @@
 
 namespace Slim\Exception;
 
-use function implode;
-
 final class HttpMethodNotAllowedException extends HttpSpecializedException
 {
     /**
@@ -46,7 +44,7 @@ public function getAllowedMethods(): array
     public function setAllowedMethods(array $methods): self
     {
         $this->allowedMethods = $methods;
-        $this->message = 'Method not allowed. Must be one of: ' . implode(', ', $methods);
+        $this->message = 'Method not allowed.';
 
         return $this;
     }

Slim/Interfaces/RouteCollectionInterface.php

@@ -4,7 +4,6 @@
 
 namespace Slim\Interfaces;
 
-use Slim\Routing\Route;
 use Slim\Routing\RouteGroup;
 
 /**
@@ -21,69 +20,69 @@ interface RouteCollectionInterface
      * @param string $path Route path.
      * @param callable|string $handler Route handler or controller action.
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function get(string $path, callable|string $handler): Route;
+    public function get(string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register a POST route.
      *
      * @param string $path
      * @param callable|string $handler
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function post(string $path, callable|string $handler): Route;
+    public function post(string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register a PUT route.
      *
      * @param string $path
      * @param callable|string $handler
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function put(string $path, callable|string $handler): Route;
+    public function put(string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register a PATCH route.
      *
      * @param string $path
      * @param callable|string $handler
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function patch(string $path, callable|string $handler): Route;
+    public function patch(string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register a DELETE route.
      *
      * @param string $path
      * @param callable|string $handler
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function delete(string $path, callable|string $handler): Route;
+    public function delete(string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register an OPTIONS route.
      *
      * @param string $path
      * @param callable|string $handler
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function options(string $path, callable|string $handler): Route;
+    public function options(string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register a route for any HTTP method.
      *
      * @param string $path
      * @param callable|string $handler
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function any(string $path, callable|string $handler): Route;
+    public function any(string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register a route with multiple HTTP methods.
@@ -92,9 +91,9 @@ public function any(string $path, callable|string $handler): Route;
      * @param string $path Route path.
      * @param callable|string $handler Route handler.
      *
-     * @return Route
+     * @return RouteInterface
      */
-    public function map(array $methods, string $path, callable|string $handler): Route;
+    public function map(array $methods, string $path, callable|string $handler): RouteInterface;
 
     /**
      * Register a group of routes under a common path prefix.

Slim/Interfaces/RouterInterface.php

@@ -5,25 +5,23 @@
 use FastRoute\RouteCollector;
 use InvalidArgumentException;
 use Psr\Http\Server\MiddlewareInterface;
-use Slim\Routing\Route;
 use Slim\Routing\RouteGroup;
-use Slim\Routing\Router;
 
 interface RouterInterface
 {
-    public function get(string $path, callable|string $handler): Route;
+    public function get(string $path, callable|string $handler): RouteInterface;
 
-    public function post(string $path, callable|string $handler): Route;
+    public function post(string $path, callable|string $handler): RouteInterface;
 
-    public function put(string $path, callable|string $handler): Route;
+    public function put(string $path, callable|string $handler): RouteInterface;
 
-    public function patch(string $path, callable|string $handler): Route;
+    public function patch(string $path, callable|string $handler): RouteInterface;
 
-    public function delete(string $path, callable|string $handler): Route;
+    public function delete(string $path, callable|string $handler): RouteInterface;
 
-    public function options(string $path, callable|string $handler): Route;
+    public function options(string $path, callable|string $handler): RouteInterface;
 
-    public function any(string $pattern, callable|string $handler): Route;
+    public function any(string $pattern, callable|string $handler): RouteInterface;
 
     /**
      * @param array<string> $methods
@@ -32,22 +30,22 @@ public function any(string $pattern, callable|string $handler): Route;
      *
      * @throws InvalidArgumentException
      */
-    public function map(array $methods, string $path, callable|string $handler): Route;
+    public function map(array $methods, string $path, callable|string $handler): RouteInterface;
 
     public function group(string $path, callable $handler): RouteGroup;
 
     public function getRouteCollector(): RouteCollector;
 
     public function setBasePath(string $basePath): void;
 
-    public function getBasePath(): string;
+    public function getBasePath(): ?string;
 
     /**
      * @return array<MiddlewareInterface|callable|string>
      */
     public function getMiddleware(): array;
 
-    public function add(MiddlewareInterface|callable|string $middleware): Router;
+    public function add(MiddlewareInterface|callable|string $middleware): RouterInterface;
 
-    public function addMiddleware(MiddlewareInterface $middleware): Router;
+    public function addMiddleware(MiddlewareInterface $middleware): RouterInterface;
 }

Slim/Middleware/BasePathMiddleware.php

@@ -20,53 +20,41 @@ final class BasePathMiddleware implements MiddlewareInterface
 {
     private RouterInterface $router;
 
-    private string $phpSapi;
-
-    /**
-     * The constructor.
-     *
-     * @param RouterInterface $router The router
-     * @param string $phpSapi The type of interface between web server and PHP
-     *
-     * Supported: 'apache2handler'
-     * Not supported: 'cgi', 'cgi-fcgi', 'fpm-fcgi', 'litespeed', 'cli-server'
-     */
-    public function __construct(RouterInterface $router, string $phpSapi = PHP_SAPI)
+    public function __construct(RouterInterface $router)
     {
-        $this->phpSapi = $phpSapi;
         $this->router = $router;
     }
 
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
-        $basePath = '';
-
-        if ($this->phpSapi === 'apache2handler') {
-            $basePath = $this->getBasePathByRequestUri($request);
+        $basePath = $this->router->getBasePath();
+        if ($basePath === null) {
+            $basePath = $this->detectBasePath($request);
+            $this->router->setBasePath($basePath);
         }
 
-        $this->router->setBasePath($basePath);
-
         return $handler->handle($request);
     }
 
     /**
-     * Return basePath for most common webservers, such as Apache.
-     * @param ServerRequestInterface $request
+     * Return basePath for most common webservers.
      */
-    private function getBasePathByRequestUri(ServerRequestInterface $request): string
+    private function detectBasePath(ServerRequestInterface $request): string
     {
-        $basePath = $request->getUri()->getPath();
-        $scriptName = $request->getServerParams()['SCRIPT_NAME'] ?? '';
+        $serverParams = $request->getServerParams();
+        $scriptName = $serverParams['SCRIPT_NAME'] ??
+            $serverParams['PHP_SELF'] ??
+            $serverParams['ORIG_SCRIPT_NAME'] ?? '';
         $scriptName = str_replace('\\', '/', dirname($scriptName, 2));
 
         if ($scriptName === '/') {
             return '';
         }
 
+        $path = $request->getUri()->getPath();
         $length = strlen($scriptName);
-        $basePath = $length > 0 ? substr($basePath, 0, $length) : $basePath;
+        $path = $length > 0 ? substr($path, 0, $length) : $path;
 
-        return strlen($basePath) > 1 ? $basePath : '';
+        return strlen($path) > 1 ? $path : '';
     }
 }