Better check for valid URLs (matomo-org#13572)

InfinityVoid · Oct 11, 2018 · 8c6e7cb · 8c6e7cb
1 parent 0b4656e
commit 8c6e7cb
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/core/UrlHelper.php b/core/UrlHelper.php
@@ -134,7 +134,9 @@ public static function getLossyUrl($url)
     public static function isLookLikeUrl($url)
     {
         return preg_match('~^(([[:alpha:]][[:alnum:]+.-]*)?:)?//(.*)$~D', $url, $matches) !== 0
-            && strlen($matches[3]) > 0;
+            && strlen($matches[3]) > 0
+            && !in_array($matches[1], array('javascript:', 'vbscript:', 'data:'))
+            ;
     }
 
     /**

diff --git a/tests/PHPUnit/Unit/UrlHelperTest.php b/tests/PHPUnit/Unit/UrlHelperTest.php
@@ -51,6 +51,11 @@ public function getUrls()
             array('http://', false),
             array(' http://', false),
             array('2fer://', false),
+            array('javascript://test.com/test', false),
+            array('javascript://alert', false),
+            array('vbscript://alert', false),
+            array('vbscript://alert', false),
+            array('data://example.com/test', false),
         );
     }