diogo
/
symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug #34366 [HttpFoundation] Allow redirecting to URLs that contain a semicolon (JayBizzle) 

This PR was merged into the 3.4 branch.

Discussion
----------

[HttpFoundation] Allow redirecting to URLs that contain a semicolon

| Q             | A
| ------------- | ---
| Branch?       | 4.3
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| License       | MIT

URLs that contain a semicolon cannot be redirected to at least in MS Edge and IE10.

Take the following example...

```
# https://ad.doubleclick.net/ddm/clk/450721234;254801234;l

// After redirect...
# https://ad.doubleclick.net/ddm/clk/450721234
```

Wrapping the URL in single quotes fixes the issue ([related reading](https://www.w3.org/TR/WCAG20-TECHS/H76.html))

Commits
-------

bd0637ebe4 [HttpFoundation] Allow redirecting to URLs that contain a semicolon
This commit is contained in:
Fabien Potencier 2019-11-17 11:00:56 +01:00
parent eaca085aa4 bd0637ebe4
commit 9e7c254460
2 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Symfony/Component/HttpFoundation/RedirectResponse.php
View File

@ -93,7 +93,7 @@ class RedirectResponse extends Response
<html>
<head>
<meta charset="UTF-8" />
<meta http-equiv="refresh" content="0;url=%1$s" />
<meta http-equiv="refresh" content="0;url=\'%1$s\'" />
<title>Redirecting to %1$s</title>
</head>

5
src/Symfony/Component/HttpFoundation/Tests/RedirectResponseTest.php
View File

@ -20,10 +20,7 @@ class RedirectResponseTest extends TestCase
{
$response = new RedirectResponse('foo.bar');
$this->assertEquals(1, preg_match(
'#<meta http-equiv="refresh" content="\d+;url=foo\.bar" />#',
preg_replace(['/\s+/', '/\'/'], [' ', '"'], $response->getContent())
));
$this->assertRegExp('#<meta http-equiv="refresh" content="\d+;url=\'foo\.bar\'" />#', preg_replace('/\s+/', ' ', $response->getContent()));
}
public function testRedirectResponseConstructorNullUrl()