Fixed sprintf format specifiers in URL breaking QueryBuilder.

Porter-connectors · Oct 16, 2018 · d6395e4 · d6395e4
1 parent 95e30b5
commit d6395e4
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/src/Net/Http/QueryBuilder.php b/src/Net/Http/QueryBuilder.php
@@ -38,6 +38,13 @@ public static function mergeQuery($url, array $query)
         $prefix = substr($url, 0, $pos);
         $suffix = substr($url, $pos);
 
-        return sprintf("$prefix%s$queryString%s$suffix", $hasQuery ? '' : '?', $hasQuery ? '&' : '');
+        return sprintf(
+            '%s%s%s%s%s',
+            $prefix,
+            $hasQuery ? '' : '?',
+            $queryString,
+            $hasQuery ? '&' : '',
+            $suffix
+        );
     }
 }
diff --git a/test/Unit/Porter/Net/Http/QueryBuilderTest.php b/test/Unit/Porter/Net/Http/QueryBuilderTest.php
@@ -82,6 +82,13 @@ public function provideQueries()
                 ['quux' => 'quuz'],
                 'http://example.com?quux=quuz&foo=bar#baz?qux',
             ],
+
+            // Tests that format specifiers in URL do not break sprintf().
+            'Format specifier (sprintf)' => [
+                'http://example.com',
+                ['foo' => '%s'],
+                'http://example.com?foo=%25s',
+            ],
         ];
     }
 }