From 3c72c97d0be2fc4d432eba0f08847d4d7acb9a0c Mon Sep 17 00:00:00 2001 From: Chris McCafferty Date: Thu, 27 Apr 2017 15:45:08 -0400 Subject: [PATCH] Issue #2867749 by pfrenssen, claudiu.cristea: Parsing an URL with another URL in the query arguments throws undefined offset notice --- core/lib/Drupal/Component/Utility/UrlHelper.php | 7 ++++++- core/tests/Drupal/Tests/Core/UrlTest.php | 1 + 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/core/lib/Drupal/Component/Utility/UrlHelper.php b/core/lib/Drupal/Component/Utility/UrlHelper.php index 04c217b6af..34a4dbe62e 100644 --- a/core/lib/Drupal/Component/Utility/UrlHelper.php +++ b/core/lib/Drupal/Component/Utility/UrlHelper.php @@ -142,7 +142,12 @@ public static function parse($url) { // External URLs: not using parse_url() here, so we do not have to rebuild // the scheme, host, and path without having any use for it. - if (strpos($url, '://') !== FALSE) { + // The URL is considered external if it contains the '://' delimiter. Since + // a URL can also be passed as a query argument, we check if this delimiter + // appears in front of the '?' query argument delimiter. + $scheme_delimiter_position = strpos($url, '://'); + $query_delimiter_position = strpos($url, '?'); + if ($scheme_delimiter_position !== FALSE && ($query_delimiter_position === FALSE || $scheme_delimiter_position < $query_delimiter_position)) { // Split off everything before the query string into 'path'. $parts = explode('?', $url); diff --git a/core/tests/Drupal/Tests/Core/UrlTest.php b/core/tests/Drupal/Tests/Core/UrlTest.php index b2e0976b0f..ff4cb01b8b 100644 --- a/core/tests/Drupal/Tests/Core/UrlTest.php +++ b/core/tests/Drupal/Tests/Core/UrlTest.php @@ -736,6 +736,7 @@ public function providerFromValidInternalUri() { ['/?page=1000'], ['?page=1000'], ['?breed=bengal&page=1000'], + ['?referrer=https://kittenfacts'], // Paths with various token formats but no leading slash. ['/[duckies]'], ['/%bunnies'], -- GitLab