fix: Variablenwerte für Links/Bilder lehnen //host, /\host und Steuerzeichen ab

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-19 14:41:06 +02:00
co-authored by Claude Sonnet 5.5
parent 5064409f9a
commit c6daae131d
2 changed files with 13 additions and 3 deletions
@@ -60,6 +60,11 @@ final class VariableValueTest extends TestCase
'links relative without slash' => ['links', 'kontakt/'],
'links with space' => ['links', 'https://example.com/a b'],
'links mailto empty' => ['links', 'mailto:'],
'links protocol-relative' => ['links', '//evil.example/x'],
'links backslash host' => ['links', '/\\evil.example/x'],
'links control character' => ['links', "https://example.com/a\x01b"],
'links delete character' => ['links', "/kontakt\x7F"],
'images control character' => ['images', "https://example.com/a\x00.jpg"],
'links too long' => ['links', 'https://example.com/' . str_repeat('a', 2000)],
'images negative' => ['images', '-5'],
'images relative path' => ['images', '/wp-content/a.jpg'],