diff --git a/changelog.md b/changelog.md index 9779ef6c..71403a6f 100644 --- a/changelog.md +++ b/changelog.md @@ -1,5 +1,13 @@ # Laravel Change Log +## Version 2.0.8 + +- Fix: Limited URI segments to 20 to protect against DDoS. + +### Upgrading from 2.0.7 + +- Replace **laravel** directory. + ## Version 2.0.7 - Fix: Fixed raw_where in query builder. diff --git a/laravel/routing/router.php b/laravel/routing/router.php index fdb4bc26..ad62ea18 100644 --- a/laravel/routing/router.php +++ b/laravel/routing/router.php @@ -181,6 +181,15 @@ protected function controller($method, $uri, $destination) $segments = explode('/', trim($uri, '/')); + // If there are more than 20 request segments, we will halt the request + // and throw an exception. This is primarily to protect against DDoS + // attacks which could overwhelm the server by feeding it too many + // segments in the URI, causing the loops in this class to bog. + if (count($segments) > 20) + { + throw new \Exception("Invalid request. There are more than 20 URI segments."); + } + if ( ! is_null($key = $this->controller_key($segments))) { // Extract the various parts of the controller call from the URI. diff --git a/public/index.php b/public/index.php index 174566ca..25c26ac7 100644 --- a/public/index.php +++ b/public/index.php @@ -3,7 +3,7 @@ * Laravel - A PHP Framework For Web Artisans * * @package Laravel - * @version 2.0.7 + * @version 2.0.8 * @author Taylor Otwell * @link http://laravel.com */