PHP < 5.6.28 parse_url() bypass HOST to return fake host

[Nytro]

Description:
------------
url like these
- http://example.com:80#@google.com/
- http://example.com:80?@google.com/

parse_url return wrong host.

https://tools.ietf.org/html/rfc3986#section-3.2

The authority component is preceded by a double slash ("//") and is
terminated by the next slash ("/"), question mark ("?"), or number
sign ("#") character, or by the end of the URI.

This problem has been fixed in 7.1.

https://github.com/php/php-src/pull/1607

But, this issue should be recognized as security issue.

example:

- bypass authentication protocol (verify hostname of callback url by parse_url)
- open redirector (verify hostname by parse_url)
- server-side request forgery (verify hostname by parse_url and get_content)


Test script:
---------------
php > echo parse_url("http://example.com:80#@google.com/")["host"];
google.com

php > echo parse_url("http://example.com:80?@google.com/")["host"];
google.com

php > echo file_get_contents("http://example.com:80#@google.com");

... contents of example.com ...


Expected result:
----------------
parse_url("http://example.com:80#@google.com/")["host"];

example.com or parse error.

Sursa: https://cxsecurity.com/issue/WLB-2017070054