SUPEE-7405 from Magento 1.9.3.0 - Hostname Validation

[sreichel]

The Zend_Validate_Hostname validation was updated to add a DNS check of the A record for the domain.

[boenrobot]

Surely, at least "suggested" for "pear/Net_IDNA2" will need to be added for this. Also, this should probably be conditional.

Also, what if I don't have the Intl extension and I don't want to depend on "pear/Net_IDNA2" either? Maybe if neither Intl or Net_IDNA2 are present, fallback to giving checkdnsrr() the raw hostname?

Also, on a related note, I'm not sure I want my hostname validation to cause a DNS lookup altogether. What if I want to add a hostname that isn't currently resolvable (because it's a domain that will be launched later)? Or is internal to a different system than the one my code is running in? In both cases, I still want to validate that I've given a syntactically valid name that may possibly exist, but not necessarily one that truly exists. I think this entire change should be behind a new option that defaults to not running the check, for the sake of backwards compatibility. The currently failing tests on 8.0 are failing exactly because the test data for this validator is not an existing hostname, though still a syntactically valid one.

[glensc]

zf2 has appropriate flags:

• https://docs.zendframework.com/zend-validator/validators/hostname/#supported-options
• https://docs.zendframework.com/zend-validator/validators/hostname/#validating-different-types-of-hostnames

also symfony has polyfill for those idn stuff:

• https://github.com/symfony/polyfill-intl-idn

[develart-projects]

@sreichel could you make that conditional? This should not be by default for sure.

[sreichel]

@develart-projects i'm stuck. Is it me, or the tests? localhost.localdomain is valid when falling back to checkdnsrr() , not?

[boenrobot]

@develart-projects i'm stuck. Is it me, or the tests? localhost.localdomain is valid when falling back to checkdnsrr() , not?

checkdnsrr() does a DNS lookup. While the domain in the test suite is syntactically valid, it is not an actual hostname reachable by the test runner, so it fails.

[sreichel]

1. Zend_Validate_HostnameTest::testBasic
   localhost.localdomain
   Failed asserting that true matches expected false.

Need some advice how to fix it.

[boenrobot]

1. Zend_Validate_HostnameTest::testBasic
   localhost.localdomain
   Failed asserting that true matches expected false.

Need some advice how to fix it.

Add an option. Default to not using it. When not using it, don't do your whole thing.

The current behavior, as is, already works for all syntactically valid hostnames. It's just that it accepts names that don't exist, which may or may not be what you need.

[sreichel]

Add an option.

How should it look like? I cant change the isValid() methods signature (adding a parameter).

Add a new constant to turn it on/off?

[develart-projects]

imo you need to test both cases. Old one and your new update, so run 2 different tests for 2 different use cases.
I think you can simply feed some common domain, like google.com for testing.