GHSA-47hf-23pw-3m8c

## Summary `DomainZones::add()` accepts arbitrary DNS record types without a whitelist and does not sanitize newline characters in the `content` field. When a DNS type not covered by the if/elseif validation chain is submitted (e.g., `NAPTR`, `PTR`, `HINFO`), content validation is entirely bypassed. Embedded newline characters in the content survive `trim()` processing, are stored in the database, and are written directly into BIND zone files via `DnsEntry::__toString()`. An authenticated customer can inject arbitrary DNS records and BIND directives (`$INCLUDE`, `$ORIGIN`, `$GENERATE`) into their domain's zone file. ## Details **Missing type whitelist — `DomainZones.php:93`:** The `type` parameter is accepted directly from user input with no validation against allowed values: ```php // lib/Froxlor/Api/Commands/DomainZones.php:93 $type = $this->getParam('type', true, 'A'); ``` The if/elseif chain at lines 170-317 validates content only for 13 known types: `A`, `AAAA`, `CAA`, `CNAME`, `DNAME`, `LOC`, `MX`, `NS`, `RP`, `SRV`, `SSHFP`, `TLSA`, `TXT`. Any type not in this list falls through with no content validation at all. There is a `TODO` comment at line 148 acknowledging missing validation: ```php // TODO regex validate content for invalid characters ``` **Missing newline sanitization — `DomainZones.php:154`:** The content field only receives `trim()`, which strips leading/trailing whitespace but preserves embedded newline characters: ```php // lib/Froxlor/Api/Commands/DomainZones.php:154 $content = trim($content); ``` **Unsafe zone file output — `DnsEntry.php:83`:** `DnsEntry::__toString()` concatenates content directly into zone file format without escaping: ```php // lib/Froxlor/Dns/DnsEntry.php:83 return $this->record . "\t" . $this->ttl . "\t" . $this->class . "\t" . $this->type . "\t" . (($this->priority >= 0 && ($this->type == 'MX' || $this->type == 'SRV')) ? $this->priority . "\t" : "") . $_content . PHP_EOL; ``` Newlines in `$_content`