Skip to content

Bug: Canonical logic accept domain.com///// #6

@janbarasek

Description

@janbarasek
  • bug report? yes
  • feature request? yes
  • version: v3.0.0

Description

In case of domain.com//// internal method match(IRequest $httpRequest): ?array got fake URL with only one slash.

Some example (CustomRouter.php):

public function match(IRequest $httpRequest): ?array
{
	$url = $httpRequest->getUrl();
	dump($url);
	dump($url->getAbsoluteUrl());
	$realUrl = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http')
		. '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	dump($realUrl);
	die;

In production mode dump looks like this:

Snímek obrazovky 2020-02-12 v 10 05 47

So object UrlScript contains invalid URL and I can open URL https://nette.org, https://nette.org/ and https://nette.org///// too without canonical redirect.

Steps To Reproduce

Open https://nette.org///// for example:

Snímek obrazovky 2020-02-12 v 10 08 39

Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions