Friendica/friendica-github
1
0
Fork 0
mirror of https://github.com/friendica/friendica synced 2025-04-25 03:50:12 +00:00
Code Issues Projects Releases Packages Wiki Activity

Ensure query parameters are URL encoded in Arguments

Browse source 
- Simplify Arguments->determine
- Remove stripZRLs and stripQueryParam Arguments methods
- Updated tests
This commit is contained in:
Hypolite Petovan 2020-09-09 00:24:44 -04:00
parent d1942afbca
commit 1b681222a4
3 changed files with 74 additions and 123 deletions
Download patch file Download diff file Expand all files Collapse all files

89
src/App/Arguments.php
View file

@ -47,7 +47,7 @@ class Arguments
*/
private $argc;
public function __construct(string $queryString = '', string $command = '', array $argv = [Module::DEFAULT], int $argc = 1)
public function __construct(string $queryString = '', string $command = '', array $argv = [], int $argc = 0)
{
$this->queryString = $queryString;
$this->command = $command;
@ -56,7 +56,7 @@ class Arguments
}
/**
* @return string The whole query string of this call
* @return string The whole query string of this call with url-encoded query parameters
*/
public function getQueryString()
{
@ -121,50 +121,27 @@ class Arguments
*/
public function determine(array $server, array $get)
{
$queryString = '';
// removing leading / - maybe a nginx problem
$server['QUERY_STRING'] = ltrim($server['QUERY_STRING'] ?? '', '/');
if (!empty($server['QUERY_STRING']) && strpos($server['QUERY_STRING'], 'pagename=') === 0) {
$queryString = urldecode(substr($server['QUERY_STRING'], 9));
} elseif (!empty($server['QUERY_STRING']) && strpos($server['QUERY_STRING'], 'q=') === 0) {
$queryString = urldecode(substr($server['QUERY_STRING'], 2));
}
// eventually strip ZRL
$queryString = $this->stripZRLs($queryString);
// eventually strip OWT
$queryString = $this->stripQueryParam($queryString, 'owt');
// removing trailing / - maybe a nginx problem
$queryString = ltrim($queryString, '/');
$queryParameters = [];
parse_str($server['QUERY_STRING'], $queryParameters);
if (!empty($get['pagename'])) {
$command = trim($get['pagename'], '/\\');
} elseif (!empty($queryParameters['pagename'])) {
$command = trim($queryParameters['pagename'], '/\\');
} elseif (!empty($get['q'])) {
// Legacy page name parameter, now conflicts with the search query parameter
$command = trim($get['q'], '/\\');
} else {
$command = Module::DEFAULT;
$command = '';
}
// fix query_string
if (!empty($command)) {
$queryString = str_replace(
$command . '&',
$command . '?',
$queryString
);
}
// unix style "homedir"
if (substr($command, 0, 1) === '~') {
$command = 'profile/' . substr($command, 1);
}
// Diaspora style profile url
if (substr($command, 0, 2) === 'u/') {
$command = 'profile/' . substr($command, 2);
}
// Remove generated and one-time use parameters
unset($queryParameters['pagename']);
unset($queryParameters['zrl']);
unset($queryParameters['owt']);
/*
* Break the URL path into C style argc/argv style arguments for our
@ -173,41 +150,17 @@ class Arguments
* [0] => 'module'
* [1] => 'arg1'
* [2] => 'arg2'
*
*
* There will always be one argument. If provided a naked domain
* URL, $this->argv[0] is set to "home".
*/
if ($command) {
$argv = explode('/', $command);
} else {
$argv = [];
}
$argv = explode('/', $command);
$argc = count($argv);
$queryString = $command . ($queryParameters ? '?' . http_build_query($queryParameters) : '');
return new Arguments($queryString, $command, $argv, $argc);
}
/**
* Strip zrl parameter from a string.
*
* @param string $queryString The input string.
*
* @return string The zrl.
*/
public function stripZRLs(string $queryString)
{
return preg_replace('/[?&]zrl=(.*?)(&|$)/ism', '$2', $queryString);
}
/**
* Strip query parameter from a string.
*
* @param string $queryString The input string.
* @param string $param
*
* @return string The query parameter.
*/
public function stripQueryParam(string $queryString, string $param)
{
return preg_replace('/[?&]' . $param . '=(.*?)(&|$)/ism', '$2', $queryString);
}
}
}