fix(url): disallowed wonky path (#4386)

RSS-Bridge · Jan 3, 2025 · be51ba1 · be51ba1
1 parent c44a76f
commit be51ba1
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/bridges/RumbleBridge.php b/bridges/RumbleBridge.php
@@ -74,9 +74,7 @@ public function collectData()
                 $item['timestamp'] = $publishedAt->getTimestamp();
             }
 
-            if (isset($publishedAt) && $publishedAt > new \DateTimeImmutable('2025-01-31')) {
-                $href = ltrim($href, '/');
-            }
+            $href = ltrim($href, '/');
             $itemUrl = Url::fromString(self::URI . $href);
             // Remove tracking parameter in query string
             $item['uri'] = $itemUrl->withQueryString(null)->__toString();

diff --git a/lib/url.php b/lib/url.php
@@ -111,6 +111,9 @@ public function withPath(string $path): self
         if (!str_starts_with($path, '/')) {
             throw new UrlException(sprintf('Path must start with forward slash: %s', $path));
         }
+        if (str_starts_with($path, '//')) {
+            throw new UrlException(sprintf('Illegal path (too many forward slashes): %s', $path));
+        }
         $clone = clone $this;
         $clone->path = $path;
         return $clone;

diff --git a/tests/UrlTest.php b/tests/UrlTest.php
@@ -36,6 +36,12 @@ public function testNormalization()
         }
     }
 
+    public function testIllegalPath()
+    {
+        $this->expectException(\UrlException::class);
+        Url::fromString('https://example.com//foo');
+    }
+
     public function testMutation()
     {
         $this->assertSame('http://example.com/foo', (Url::fromString('http://example.com/'))->withPath('/foo')->__toString());