Skip to content

1.2.0
Compare
Choose a tag to compare
@dbu dbu released this 01 Dec 15:09
1.2.0
This tag was signed with the committer’s verified signature. The key has expired.
dbu David Buchmann
GPG key ID: 3FC9B65897200E2C
Expired
Learn about vigilant mode.
d11c832
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

Added

  • Adds UriIntegrationTest::testGetPathNormalizesMultipleLeadingSlashesToSingleSlashToPreventXSS(), UriIntegrationTest::testStringRepresentationWithMultipleSlashes(array $test), and RequestIntegrationTest::testGetRequestTargetInOriginFormNormalizesUriWithMultipleLeadingSlashesInPath().
    These validate that a path containing multiple leading slashes is (a) represented with a single slash when calling UriInterface::getPath(), and (b) represented without changes when calling UriInterface::__toString(), including when calling RequestInterface::getRequestTarget() (which returns the path without the URI authority by default, to comply with origin-form).
    This is done to validate mitigations for CVE-2015-3257.

Changed

  • Modifies UriIntegrationTest::testPathWithMultipleSlashes() to only validate multiple slashes in the middle of a path.
    Multiple leading slashes are covered with the newly introduced tests.
Assets 2
Loading