MDL-71922 file: Enhance endless recursion requests protection

repository/url/lib.php

@@ -36,7 +36,11 @@
  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  */
 class repository_url extends repository {
+    /** @var int Maximum time of recursion. */
+    const MAX_RECURSION_TIME = 5;
     var $processedfiles = array();
+    /** @var int Recursion counter. */
+    var $recursioncounter = 0;
 
     /**
      * @param int $repositoryid
@@ -127,7 +131,16 @@ protected function parse_file($baseurl, $relativeurl, &$list, $mainfile = false)
             $url = htmlspecialchars_decode(url_to_absolute($baseurl, $relativeurl));
         }
         if (in_array($url, $this->processedfiles)) {
-            // avoid endless recursion
+            // Avoid endless recursion for the same URL with same parameters.
+            return;
+        }
+        // Remove the query string before check.
+        $recursioncheckurl = preg_replace('/\?.*/', '', $url);
+        if (in_array($recursioncheckurl, $this->processedfiles)) {
+            $this->recursioncounter++;
+        }
+        if ($this->recursioncounter >= self::MAX_RECURSION_TIME) {
+            // Avoid endless recursion for the same URL with different parameters.
             return;
         }
         $this->processedfiles[] = $url;