Response::redirect() link is printed only for https? protocols [Closes …

…#24]
nette · Nov 15, 2014 · 88e0ba8 · 88e0ba8
1 parent c2ca723
commit 88e0ba8
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 2 deletions.
diff --git a/src/Http/Response.php b/src/Http/Response.php
@@ -147,8 +147,10 @@ public function redirect($url, $code = self::S302_FOUND)
 	{
 		$this->setCode($code);
 		$this->setHeader('Location', $url);
-		$escapedUrl = htmlSpecialChars($url, ENT_IGNORE | ENT_QUOTES);
-		echo "<h1>Redirect</h1>\n\n<p><a href=\"$escapedUrl\">Please click here to continue</a>.</p>";
+		if (preg_match('#^https?:|^\s*+[a-z0-9+.-]*+[^:]#i', $url)) {
+			$escapedUrl = htmlSpecialChars($url, ENT_IGNORE | ENT_QUOTES);
+			echo "<h1>Redirect</h1>\n\n<p><a href=\"$escapedUrl\">Please click here to continue</a>.</p>";
+		}
 	}
 
 

diff --git a/tests/Http/Response.redirect.phpt b/tests/Http/Response.redirect.phpt
@@ -0,0 +1,34 @@
+<?php
+
+/**
+ * Test: Nette\Http\Response redirect.
+ */
+
+use Nette\Http,
+	Tester\Assert;
+
+
+require __DIR__ . '/../bootstrap.php';
+
+
+$response = new Http\Response;
+
+ob_start();
+$response->redirect('http://nette.org/&');
+Assert::same("<h1>Redirect</h1>\n\n<p><a href=\"http://nette.org/&amp;\">Please click here to continue</a>.</p>", ob_get_clean());
+
+if (PHP_SAPI !== 'cli') {
+	Assert::contains('Location: http://nette.org/&', headers_list());
+}
+
+
+ob_start();
+$response->redirect(' javascript:alert(1)');
+Assert::same('', ob_get_clean());
+
+if (PHP_SAPI !== 'cli') {
+	Assert::contains('Location:  javascript:alert(1)', headers_list());
+}
+
+
+$response->setCode(200);