From cc53d95ed1f470a8143e8a56aa3192e2c4b3e13e Mon Sep 17 00:00:00 2001
From: El RIDO <elrido@gmx.net>
Date: Sun, 20 Jan 2019 11:05:34 +0100
Subject: [PATCH 1/9] extending test cases to reproduce the issue from #396,
 causing the existing logic to now fail the tests

---
 js/common.js        | 17 ++++++---
 js/test/Model.js    | 15 +++++---
 tst/RequestTest.php | 86 ++++++++++++++++++++++++++++++++++++---------
 3 files changed, 92 insertions(+), 26 deletions(-)

diff --git a/js/common.js b/js/common.js
index bc3bd39..be1cf37 100644
--- a/js/common.js
+++ b/js/common.js
@@ -22,11 +22,13 @@ require('./bootstrap-3.3.7');
 require('./privatebin');
 
 // internal variables
-var a2zString = ['a','b','c','d','e','f','g','h','i','j','k','l','m',
-                     'n','o','p','q','r','s','t','u','v','w','x','y','z'],
-    alnumString = a2zString.concat(['0','1','2','3','4','5','6','7','8','9']),
-    queryString = alnumString.concat(['+','%','&','.','*','-','_']),
-    hashString = queryString.concat(['!']),
+var a2zString    = ['a','b','c','d','e','f','g','h','i','j','k','l','m',
+                    'n','o','p','q','r','s','t','u','v','w','x','y','z'],
+    digitString  = ['0','1','2','3','4','5','6','7','8','9'],
+    alnumString  = a2zString.concat(digitString),
+    hexString    = digitString.concat(['a','b','c','d','e','f']),
+    queryString  = alnumString.concat(['+','%','&','.','*','-','_']),
+    hashString   = queryString.concat(['!']),
     base64String = alnumString.concat(['+','/','=']).concat(
         a2zString.map(function(c) {
             return c.toUpperCase();
@@ -123,6 +125,11 @@ exports.jscAlnumString = function() {
     return jsc.elements(alnumString);
 };
 
+//provides random characters allowed in hexadecimal notation
+exports.jscHexString = function() {
+    return jsc.elements(hexString);
+};
+
 // provides random characters allowed in GET queries
 exports.jscQueryString = function() {
     return jsc.elements(queryString);
diff --git a/js/test/Model.js b/js/test/Model.js
index 18ec8a8..1ed8812 100644
--- a/js/test/Model.js
+++ b/js/test/Model.js
@@ -81,18 +81,23 @@ describe('Model', function () {
             'returns the query string without separator, if any',
             jsc.nearray(common.jscA2zString()),
             jsc.nearray(common.jscA2zString()),
-            jsc.nearray(common.jscHashString()),
+            jsc.tuple(new Array(16).fill(common.jscHexString)),
+            jsc.array(common.jscQueryString()),
+            jsc.array(common.jscQueryString()),
             'string',
-            function (schema, address, query, fragment) {
-                var queryString = query.join(''),
-                    clean = jsdom('', {
+            function (schema, address, pasteId, queryStart, queryEnd, fragment) {
+                var pasteIdString    = pasteId.join(''),
+                    queryStartString = queryStart.join('') + (queryStart.length > 0 ? '&' : ''),
+                    queryEndString   = (queryEnd.length > 0 ? '&' : '') + queryEnd.join(''),
+                    queryString      = queryStartString + pasteIdString + queryEndString,
+                    clean            = jsdom('', {
                         url: schema.join('') + '://' + address.join('') +
                              '/?' + queryString + '#' + fragment
                     }),
                     result = $.PrivateBin.Model.getPasteId();
                 $.PrivateBin.Model.reset();
                 clean();
-                return queryString === result;
+                return pasteIdString === result;
             }
         );
         jsc.property(
diff --git a/tst/RequestTest.php b/tst/RequestTest.php
index 29b0dad..c13656d 100644
--- a/tst/RequestTest.php
+++ b/tst/RequestTest.php
@@ -21,6 +21,36 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_POST   = array();
     }
 
+    /**
+     * Returns 16 random hexadecimal characters.
+     *
+     * @access public
+     * @return string
+     */
+    public function getRandomId()
+    {
+        // 8 binary bytes are 16 characters long in hex
+        return bin2hex(random_bytes(8));
+    }
+
+    /**
+     * Returns random query safe characters.
+     *
+     * @access public
+     * @return string
+     */
+    public function getRandomQueryChars()
+    {
+        $queryChars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ=';
+        $queryCharCount = strlen($queryChars) - 1;
+        $resultLength = random_int(1, 10);
+        $result = '';
+        for ($i = 0; $i < $resultLength; ++$i) {
+            $result .= $queryChars[random_int(0, $queryCharCount)];
+        }
+        return $result;
+    }
+
     public function testView()
     {
         $this->reset();
@@ -33,24 +63,26 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testRead()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
-        $_SERVER['QUERY_STRING']   = 'foo';
+        $_SERVER['QUERY_STRING']   = $id;
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('read', $request->getOperation());
     }
 
     public function testDelete()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
-        $_GET['pasteid']           = 'foo';
+        $_GET['pasteid']           = $id;
         $_GET['deletetoken']       = 'bar';
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
         $this->assertEquals('delete', $request->getOperation());
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('bar', $request->getParam('deletetoken'));
     }
 
@@ -84,74 +116,96 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testApiRead()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'application/json, text/javascript, */*; q=0.01';
-        $_SERVER['QUERY_STRING']   = 'foo';
+        $_SERVER['QUERY_STRING']   = $id;
         $request                   = new Request;
         $this->assertTrue($request->isJsonApiCall(), 'is JSON Api call');
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('read', $request->getOperation());
     }
 
     public function testApiDelete()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD']        = 'POST';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
-        $_SERVER['QUERY_STRING']          = 'foo';
+        $_SERVER['QUERY_STRING']          = $id;
         $_POST['deletetoken']             = 'bar';
         $request                          = new Request;
         $this->assertTrue($request->isJsonApiCall(), 'is JSON Api call');
         $this->assertEquals('delete', $request->getOperation());
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('bar', $request->getParam('deletetoken'));
     }
 
     public function testReadWithNegotiation()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/html,text/html; charset=UTF-8,application/xhtml+xml, application/xml;q=0.9,*/*;q=0.8, text/csv,application/json';
-        $_SERVER['QUERY_STRING']   = 'foo';
+        $_SERVER['QUERY_STRING']   = $id;
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('read', $request->getOperation());
     }
 
     public function testReadWithXhtmlNegotiation()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'application/xhtml+xml,text/html,text/html; charset=UTF-8, application/xml;q=0.9,*/*;q=0.8, text/csv,application/json';
-        $_SERVER['QUERY_STRING']   = 'foo';
+        $_SERVER['QUERY_STRING']   = $id;
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('read', $request->getOperation());
     }
 
     public function testApiReadWithNegotiation()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/plain,text/csv, application/xml;q=0.9, application/json, text/html,text/html; charset=UTF-8,application/xhtml+xml, */*;q=0.8';
-        $_SERVER['QUERY_STRING']   = 'foo';
+        $_SERVER['QUERY_STRING']   = $id;
         $request                   = new Request;
         $this->assertTrue($request->isJsonApiCall(), 'is JSON Api call');
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('read', $request->getOperation());
     }
 
     public function testReadWithFailedNegotiation()
     {
         $this->reset();
+        $id = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/plain,text/csv, application/xml;q=0.9, */*;q=0.8';
-        $_SERVER['QUERY_STRING']   = 'foo';
+        $_SERVER['QUERY_STRING']   = $id;
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
-        $this->assertEquals('foo', $request->getParam('pasteid'));
+        $this->assertEquals($id, $request->getParam('pasteid'));
         $this->assertEquals('read', $request->getOperation());
     }
+
+    public function testPasteIdExtraction()
+    {
+        $this->reset();
+        $id = $this->getRandomId();
+        $queryParams = array($id);
+        $queryParamCount = random_int(1, 5);
+        for ($i = 0; $i < $queryParamCount; ++$i) {
+            array_push($queryParams, $this->getRandomQueryChars());
+        }
+        shuffle($queryParams);
+        $_SERVER['REQUEST_METHOD'] = 'GET';
+        $_SERVER['QUERY_STRING']   = implode('&', $queryParams);
+        $request                   = new Request;
+        $this->assertEquals($id, $request->getParam('pasteid'));
+    }
 }

From 79a858f176947db963a202fecdabb62a89979d82 Mon Sep 17 00:00:00 2001
From: El RIDO <elrido@gmx.net>
Date: Sun, 20 Jan 2019 12:20:37 +0100
Subject: [PATCH 2/9] extracting only the 16 hex characters of the query string
 as paste ID, addressing #396

---
 js/privatebin.js  | 2 +-
 js/test/Prompt.js | 2 +-
 lib/Request.php   | 4 +++-
 tpl/bootstrap.php | 2 +-
 tpl/page.php      | 2 +-
 5 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/js/privatebin.js b/js/privatebin.js
index 57eb273..08aea83 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -745,7 +745,7 @@ jQuery.PrivateBin = (function($, sjcl, Base64, RawDeflate) {
         {
             if (id === null) {
                 // Attention: This also returns the delete token inside of the ID, if it is specified
-                id = window.location.search.substring(1);
+                id = (window.location.search.match(/[a-z0-9]{16}/) || [''])[0];
 
                 if (id === '') {
                     throw 'no paste id given';
diff --git a/js/test/Prompt.js b/js/test/Prompt.js
index 0e65b25..038f7a0 100644
--- a/js/test/Prompt.js
+++ b/js/test/Prompt.js
@@ -16,7 +16,7 @@ describe('Prompt', function () {
             'string',
             function (password) {
                 password = password.replace(/\r+/g, '');
-                var clean = jsdom('', {url: 'ftp://example.com/?0'});
+                var clean = jsdom('', {url: 'ftp://example.com/?0000000000000000'});
                 $('body').html(
                     '<div id="passwordmodal" class="modal fade" role="dialog">' +
                     '<div class="modal-dialog"><div class="modal-content">' +
diff --git a/lib/Request.php b/lib/Request.php
index c9dd6c0..431542a 100644
--- a/lib/Request.php
+++ b/lib/Request.php
@@ -100,7 +100,9 @@ class Request
             array_key_exists('QUERY_STRING', $_SERVER) &&
             !empty($_SERVER['QUERY_STRING'])
         ) {
-            $this->_params['pasteid'] = $_SERVER['QUERY_STRING'];
+            $this->_params['pasteid'] = preg_match(
+                '/[a-f0-9]{16}/', $_SERVER['QUERY_STRING'], $match
+            ) ? $match[0] : 'invalid id';
         }
 
         // prepare operation, depending on current parameters
diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php
index ffbccaa..64bebc4 100644
--- a/tpl/bootstrap.php
+++ b/tpl/bootstrap.php
@@ -76,7 +76,7 @@ if ($MARKDOWN):
 endif;
 ?>
 		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.7.js" integrity="sha512-VnKJHLosO8z2ojNvWk9BEKYqnhZyWK9rM90FgZUUEp/PRnUqR5OLLKE0a3BkVmn7YgB7LXRrjHgFHQYKd6DAIA==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-gFuGN7PD3lRe5ZTe/S2NfugOrjqNWYgEwBmb3Grk2EVckz1UbqVPs8+PQp6SmQ0preKNpXC50omnwGh4MPkoRg==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-qY0AJdr7OzoJBiuVUO9w1HZv8WXoYpbCocgvHW+gMMic9CDU/pwohPkdqbaTh4SkHpRQ8cNpRO7ezTyBs0KMbA==" crossorigin="anonymous"></script>
 		<!--[if lt IE 10]>
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 		<![endif]-->
diff --git a/tpl/page.php b/tpl/page.php
index 2c142a8..685a207 100644
--- a/tpl/page.php
+++ b/tpl/page.php
@@ -54,7 +54,7 @@ if ($MARKDOWN):
 endif;
 ?>
 		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.7.js" integrity="sha512-VnKJHLosO8z2ojNvWk9BEKYqnhZyWK9rM90FgZUUEp/PRnUqR5OLLKE0a3BkVmn7YgB7LXRrjHgFHQYKd6DAIA==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-gFuGN7PD3lRe5ZTe/S2NfugOrjqNWYgEwBmb3Grk2EVckz1UbqVPs8+PQp6SmQ0preKNpXC50omnwGh4MPkoRg==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-qY0AJdr7OzoJBiuVUO9w1HZv8WXoYpbCocgvHW+gMMic9CDU/pwohPkdqbaTh4SkHpRQ8cNpRO7ezTyBs0KMbA==" crossorigin="anonymous"></script>
 		<!--[if lt IE 10]>
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 		<![endif]-->

From e3d7ac444234e5f8c72da9ce190f1b014857227c Mon Sep 17 00:00:00 2001
From: El RIDO <elrido@gmx.net>
Date: Sun, 20 Jan 2019 12:28:03 +0100
Subject: [PATCH 3/9] apply StyleCI recommendations

---
 tst/RequestTest.php | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/tst/RequestTest.php b/tst/RequestTest.php
index c13656d..97891c9 100644
--- a/tst/RequestTest.php
+++ b/tst/RequestTest.php
@@ -41,9 +41,9 @@ class RequestTest extends PHPUnit_Framework_TestCase
      */
     public function getRandomQueryChars()
     {
-        $queryChars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ=';
+        $queryChars     = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ=';
         $queryCharCount = strlen($queryChars) - 1;
-        $resultLength = random_int(1, 10);
+        $resultLength   = random_int(1, 10);
         $result = '';
         for ($i = 0; $i < $resultLength; ++$i) {
             $result .= $queryChars[random_int(0, $queryCharCount)];
@@ -63,7 +63,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testRead()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['QUERY_STRING']   = $id;
         $request                   = new Request;
@@ -75,7 +75,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testDelete()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_GET['pasteid']           = $id;
         $_GET['deletetoken']       = 'bar';
@@ -116,7 +116,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testApiRead()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'application/json, text/javascript, */*; q=0.01';
         $_SERVER['QUERY_STRING']   = $id;
@@ -129,7 +129,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testApiDelete()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                               = $this->getRandomId();
         $_SERVER['REQUEST_METHOD']        = 'POST';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['QUERY_STRING']          = $id;
@@ -144,7 +144,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testReadWithNegotiation()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/html,text/html; charset=UTF-8,application/xhtml+xml, application/xml;q=0.9,*/*;q=0.8, text/csv,application/json';
         $_SERVER['QUERY_STRING']   = $id;
@@ -157,7 +157,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testReadWithXhtmlNegotiation()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'application/xhtml+xml,text/html,text/html; charset=UTF-8, application/xml;q=0.9,*/*;q=0.8, text/csv,application/json';
         $_SERVER['QUERY_STRING']   = $id;
@@ -170,7 +170,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testApiReadWithNegotiation()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/plain,text/csv, application/xml;q=0.9, application/json, text/html,text/html; charset=UTF-8,application/xhtml+xml, */*;q=0.8';
         $_SERVER['QUERY_STRING']   = $id;
@@ -183,7 +183,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testReadWithFailedNegotiation()
     {
         $this->reset();
-        $id = $this->getRandomId();
+        $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/plain,text/csv, application/xml;q=0.9, */*;q=0.8';
         $_SERVER['QUERY_STRING']   = $id;
@@ -196,8 +196,8 @@ class RequestTest extends PHPUnit_Framework_TestCase
     public function testPasteIdExtraction()
     {
         $this->reset();
-        $id = $this->getRandomId();
-        $queryParams = array($id);
+        $id              = $this->getRandomId();
+        $queryParams     = array($id);
         $queryParamCount = random_int(1, 5);
         for ($i = 0; $i < $queryParamCount; ++$i) {
             array_push($queryParams, $this->getRandomQueryChars());

From 6beea8f2f4f0e37db8c7d541a2233b921ff907b0 Mon Sep 17 00:00:00 2001
From: El RIDO <elrido@gmx.net>
Date: Sun, 20 Jan 2019 12:29:27 +0100
Subject: [PATCH 4/9] apply yet another StyleCI recommendations

---
 tst/RequestTest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tst/RequestTest.php b/tst/RequestTest.php
index 97891c9..a647224 100644
--- a/tst/RequestTest.php
+++ b/tst/RequestTest.php
@@ -44,7 +44,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $queryChars     = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ=';
         $queryCharCount = strlen($queryChars) - 1;
         $resultLength   = random_int(1, 10);
-        $result = '';
+        $result         = '';
         for ($i = 0; $i < $resultLength; ++$i) {
             $result .= $queryChars[random_int(0, $queryCharCount)];
         }

From 541fff199aed3140f045778b80d9e5713577d047 Mon Sep 17 00:00:00 2001
From: rugk <rugk@posteo.de>
Date: Mon, 21 Jan 2019 23:06:25 +0100
Subject: [PATCH 5/9] Put PHP paste request into own function

---
 lib/Request.php | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/Request.php b/lib/Request.php
index 431542a..1487b4b 100644
--- a/lib/Request.php
+++ b/lib/Request.php
@@ -72,6 +72,19 @@ class Request
      */
     private $_isJsonApi = false;
 
+    /**
+     * Return the paste ID of the current paste.
+     *
+     * @access private
+     * @return string
+     */
+    private function getPasteId()
+    {
+        return preg_match(
+            '/[a-f0-9]{16}/', $_SERVER['QUERY_STRING'], $match
+        ) ? $match[0] : 'invalid id';
+    }
+
     /**
      * Constructor
      *
@@ -100,9 +113,7 @@ class Request
             array_key_exists('QUERY_STRING', $_SERVER) &&
             !empty($_SERVER['QUERY_STRING'])
         ) {
-            $this->_params['pasteid'] = preg_match(
-                '/[a-f0-9]{16}/', $_SERVER['QUERY_STRING'], $match
-            ) ? $match[0] : 'invalid id';
+            $this->_params['pasteid'] = $this->getPasteId();
         }
 
         // prepare operation, depending on current parameters

From 7cb942aca3048228f108034a16c5d9bac9c53120 Mon Sep 17 00:00:00 2001
From: rugk <rugk@posteo.de>
Date: Mon, 21 Jan 2019 23:19:41 +0100
Subject: [PATCH 6/9] Make PHP paste ID function more robust

---
 lib/Request.php | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/lib/Request.php b/lib/Request.php
index 1487b4b..5f25e7f 100644
--- a/lib/Request.php
+++ b/lib/Request.php
@@ -80,9 +80,17 @@ class Request
      */
     private function getPasteId()
     {
-        return preg_match(
-            '/[a-f0-9]{16}/', $_SERVER['QUERY_STRING'], $match
-        ) ? $match[0] : 'invalid id';
+        // RegEx to check for valid paste ID (16 base64 chars)
+        $pasteIdRegEx = '/^[a-f0-9]{16}$/';
+
+        foreach ($_GET as $key => $value) {
+            // only return if value is empty and key matches RegEx
+            if (($value === "") and preg_match($pasteIdRegEx, $key, $match)) {
+                return $match[0];
+            };
+        }
+
+        return 'invalid id';
     }
 
     /**

From 99d49a56ba0bf7b930f774a8b98a4227433777d4 Mon Sep 17 00:00:00 2001
From: rugk <rugk@posteo.de>
Date: Mon, 21 Jan 2019 23:49:33 +0100
Subject: [PATCH 7/9] Fix PHPunit tests

---
 tst/ConfigurationTestGenerator.php | 1 +
 tst/ControllerTest.php             | 8 ++++++++
 tst/JsonApiTest.php                | 3 +++
 tst/RequestTest.php                | 8 ++++++++
 4 files changed, 20 insertions(+)

diff --git a/tst/ConfigurationTestGenerator.php b/tst/ConfigurationTestGenerator.php
index ccf7c82..0aaec88 100755
--- a/tst/ConfigurationTestGenerator.php
+++ b/tst/ConfigurationTestGenerator.php
@@ -507,6 +507,7 @@ EOT;
                 $code .= PHP_EOL . <<<'EOT'
         $this->_model->create(Helper::getPasteId(), Helper::getPaste());
         $_SERVER['QUERY_STRING'] = Helper::getPasteId();
+        $_GET[Helper::getPasteId()] = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
 EOT;
                 break;
diff --git a/tst/ControllerTest.php b/tst/ControllerTest.php
index 432c829..6c6f575 100644
--- a/tst/ControllerTest.php
+++ b/tst/ControllerTest.php
@@ -680,6 +680,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
     public function testReadInvalidId()
     {
         $_SERVER['QUERY_STRING']          = 'foo';
+        $_GET["foo"]                      = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
@@ -696,6 +697,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
     public function testReadNonexisting()
     {
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
@@ -714,6 +716,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
         $expiredPaste = Helper::getPaste(array('expire_date' => 1344803344));
         $this->_model->create(Helper::getPasteId(), $expiredPaste);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
@@ -732,6 +735,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
         $paste = Helper::getPaste(array('burnafterreading' => true));
         $this->_model->create(Helper::getPasteId(), $paste);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
@@ -760,6 +764,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
         $paste = Helper::getPaste();
         $this->_model->create(Helper::getPasteId(), $paste);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
@@ -790,6 +795,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
         );
         $this->_model->create(Helper::getPasteId(), $paste);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
@@ -897,6 +903,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $_POST['deletetoken']             = 'burnafterreading';
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['REQUEST_METHOD']        = 'POST';
         ob_start();
@@ -917,6 +924,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
         $this->assertTrue($this->_model->exists(Helper::getPasteId()), 'paste exists before deleting data');
         $_POST['deletetoken']             = 'burnafterreading';
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['REQUEST_METHOD']        = 'POST';
         ob_start();
diff --git a/tst/JsonApiTest.php b/tst/JsonApiTest.php
index 1f8d53a..6914d3f 100644
--- a/tst/JsonApiTest.php
+++ b/tst/JsonApiTest.php
@@ -82,6 +82,7 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
         file_put_contents($file, http_build_query($paste));
         Request::setInputStream($file);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['REQUEST_METHOD']        = 'PUT';
         $_SERVER['REMOTE_ADDR']           = '::1';
@@ -117,6 +118,7 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
         )));
         Request::setInputStream($file);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['REQUEST_METHOD']        = 'DELETE';
         ob_start();
@@ -164,6 +166,7 @@ class JsonApiTest extends PHPUnit_Framework_TestCase
         unset($paste['attachmentname']);
         $this->_model->create(Helper::getPasteId(), $paste);
         $_SERVER['QUERY_STRING']          = Helper::getPasteId();
+        $_GET[Helper::getPasteId()]       = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
diff --git a/tst/RequestTest.php b/tst/RequestTest.php
index a647224..b23104f 100644
--- a/tst/RequestTest.php
+++ b/tst/RequestTest.php
@@ -66,6 +66,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $id                        = $this->getRandomId();
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['QUERY_STRING']   = $id;
+        $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
         $this->assertEquals($id, $request->getParam('pasteid'));
@@ -120,6 +121,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'application/json, text/javascript, */*; q=0.01';
         $_SERVER['QUERY_STRING']   = $id;
+        $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertTrue($request->isJsonApiCall(), 'is JSON Api call');
         $this->assertEquals($id, $request->getParam('pasteid'));
@@ -133,6 +135,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_SERVER['REQUEST_METHOD']        = 'POST';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['QUERY_STRING']          = $id;
+        $_GET                             = [$id => ''];
         $_POST['deletetoken']             = 'bar';
         $request                          = new Request;
         $this->assertTrue($request->isJsonApiCall(), 'is JSON Api call');
@@ -148,6 +151,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/html,text/html; charset=UTF-8,application/xhtml+xml, application/xml;q=0.9,*/*;q=0.8, text/csv,application/json';
         $_SERVER['QUERY_STRING']   = $id;
+        $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
         $this->assertEquals($id, $request->getParam('pasteid'));
@@ -161,6 +165,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'application/xhtml+xml,text/html,text/html; charset=UTF-8, application/xml;q=0.9,*/*;q=0.8, text/csv,application/json';
         $_SERVER['QUERY_STRING']   = $id;
+        $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
         $this->assertEquals($id, $request->getParam('pasteid'));
@@ -174,6 +179,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/plain,text/csv, application/xml;q=0.9, application/json, text/html,text/html; charset=UTF-8,application/xhtml+xml, */*;q=0.8';
         $_SERVER['QUERY_STRING']   = $id;
+        $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertTrue($request->isJsonApiCall(), 'is JSON Api call');
         $this->assertEquals($id, $request->getParam('pasteid'));
@@ -187,6 +193,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['HTTP_ACCEPT']    = 'text/plain,text/csv, application/xml;q=0.9, */*;q=0.8';
         $_SERVER['QUERY_STRING']   = $id;
+        $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertFalse($request->isJsonApiCall(), 'is HTML call');
         $this->assertEquals($id, $request->getParam('pasteid'));
@@ -205,6 +212,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         shuffle($queryParams);
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['QUERY_STRING']   = implode('&', $queryParams);
+        $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertEquals($id, $request->getParam('pasteid'));
     }

From c2a46b7af72bbbd921c9b7906b0186b40ef40920 Mon Sep 17 00:00:00 2001
From: rugk <rugk@posteo.de>
Date: Tue, 22 Jan 2019 00:07:28 +0100
Subject: [PATCH 8/9] Make JS function more robust

---
 js/privatebin.js  | 41 ++++++++++++++++++++++++++++++++++++-----
 tpl/bootstrap.php |  2 +-
 tpl/page.php      |  2 +-
 3 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/js/privatebin.js b/js/privatebin.js
index 08aea83..cf74733 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -743,13 +743,44 @@ jQuery.PrivateBin = (function($, sjcl, Base64, RawDeflate) {
          */
         me.getPasteId = function()
         {
-            if (id === null) {
-                // Attention: This also returns the delete token inside of the ID, if it is specified
-                id = (window.location.search.match(/[a-z0-9]{16}/) || [''])[0];
+            const idRegEx = /^[a-z0-9]{16}$/;
+            const idRegExFind = /[a-z0-9]{16}/;
 
-                if (id === '') {
-                    throw 'no paste id given';
+            // return cached value
+            if (id !== null) {
+                return id;
+            }
+
+            // do use URL interface, if possible
+            if (window.URL && window.URL.prototype && ('searchParams' in window.URL.prototype)) {
+                try {
+                    const url = new URL(window.location);
+
+                    for (const param of url.searchParams) {
+                        const key = param[0];
+                        const value = param[1];
+
+                        if (value === '' && idRegEx.test(key)) {
+                            // safe, as the whole regex is matched
+                            id = key;
+                            return id;
+                        }
+                    }
+                } catch (e) {
+                    // fallback below
+                    console.error('URL interface not properly supported, error:', e);
                 }
+            } else {
+                console.warn('URL interface appears not to be supported in this browser.');
+            }
+
+            // fallback to simple RegEx
+            console.warn('fallback to simple RegEx search');
+            // Attention: This also returns the delete token inside of the ID, if it is specified
+            id = (window.location.search.match(idRegExFind) || [''])[0];
+
+            if (id === '') {
+                throw 'no paste id given';
             }
 
             return id;
diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php
index 64bebc4..fdc1b51 100644
--- a/tpl/bootstrap.php
+++ b/tpl/bootstrap.php
@@ -76,7 +76,7 @@ if ($MARKDOWN):
 endif;
 ?>
 		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.7.js" integrity="sha512-VnKJHLosO8z2ojNvWk9BEKYqnhZyWK9rM90FgZUUEp/PRnUqR5OLLKE0a3BkVmn7YgB7LXRrjHgFHQYKd6DAIA==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-qY0AJdr7OzoJBiuVUO9w1HZv8WXoYpbCocgvHW+gMMic9CDU/pwohPkdqbaTh4SkHpRQ8cNpRO7ezTyBs0KMbA==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-tRRKkyV2RYlU1b/PdUmLigAV8mAQpklblVO071AcQs5QbeUwBnK2L5zjbscm2+B2eRJ06luEisXuPowvFHN6fA==" crossorigin="anonymous"></script>
 		<!--[if lt IE 10]>
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 		<![endif]-->
diff --git a/tpl/page.php b/tpl/page.php
index 685a207..8d87ea6 100644
--- a/tpl/page.php
+++ b/tpl/page.php
@@ -54,7 +54,7 @@ if ($MARKDOWN):
 endif;
 ?>
 		<script type="text/javascript" data-cfasync="false" src="js/purify-1.0.7.js" integrity="sha512-VnKJHLosO8z2ojNvWk9BEKYqnhZyWK9rM90FgZUUEp/PRnUqR5OLLKE0a3BkVmn7YgB7LXRrjHgFHQYKd6DAIA==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-qY0AJdr7OzoJBiuVUO9w1HZv8WXoYpbCocgvHW+gMMic9CDU/pwohPkdqbaTh4SkHpRQ8cNpRO7ezTyBs0KMbA==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-tRRKkyV2RYlU1b/PdUmLigAV8mAQpklblVO071AcQs5QbeUwBnK2L5zjbscm2+B2eRJ06luEisXuPowvFHN6fA==" crossorigin="anonymous"></script>
 		<!--[if lt IE 10]>
 		<style type="text/css">body {padding-left:60px;padding-right:60px;} #ienotice {display:block;} #oldienotice {display:block;}</style>
 		<![endif]-->

From 34c64acb75d6924e826ffd44928057987a952b34 Mon Sep 17 00:00:00 2001
From: rugk <rugk@posteo.de>
Date: Tue, 22 Jan 2019 00:12:02 +0100
Subject: [PATCH 9/9] Apply StyleCi recommendation

---
 lib/Request.php        | 4 ++--
 tst/ControllerTest.php | 2 +-
 tst/RequestTest.php    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/Request.php b/lib/Request.php
index 5f25e7f..48472bc 100644
--- a/lib/Request.php
+++ b/lib/Request.php
@@ -85,9 +85,9 @@ class Request
 
         foreach ($_GET as $key => $value) {
             // only return if value is empty and key matches RegEx
-            if (($value === "") and preg_match($pasteIdRegEx, $key, $match)) {
+            if (($value === '') and preg_match($pasteIdRegEx, $key, $match)) {
                 return $match[0];
-            };
+            }
         }
 
         return 'invalid id';
diff --git a/tst/ControllerTest.php b/tst/ControllerTest.php
index 6c6f575..88d5301 100644
--- a/tst/ControllerTest.php
+++ b/tst/ControllerTest.php
@@ -680,7 +680,7 @@ class ControllerTest extends PHPUnit_Framework_TestCase
     public function testReadInvalidId()
     {
         $_SERVER['QUERY_STRING']          = 'foo';
-        $_GET["foo"]                      = '';
+        $_GET['foo']                      = '';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         ob_start();
         new Controller;
diff --git a/tst/RequestTest.php b/tst/RequestTest.php
index b23104f..e5567d6 100644
--- a/tst/RequestTest.php
+++ b/tst/RequestTest.php
@@ -135,7 +135,7 @@ class RequestTest extends PHPUnit_Framework_TestCase
         $_SERVER['REQUEST_METHOD']        = 'POST';
         $_SERVER['HTTP_X_REQUESTED_WITH'] = 'JSONHttpRequest';
         $_SERVER['QUERY_STRING']          = $id;
-        $_GET                             = [$id => ''];
+        $_GET                             = array($id => '');
         $_POST['deletetoken']             = 'bar';
         $request                          = new Request;
         $this->assertTrue($request->isJsonApiCall(), 'is JSON Api call');