You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm getting an error when sanitizing a text with urls. I have multiple allowed hosts in my config, and thus html sanitization for urls fails with access to undefined keys when calling UrlSanitizer->matchAllowedHostParts.
Here are details about narrowing down the issue to `UrlSanitizer->matchAllowedHostParts`
This becomes quite obvious that when looking at `matchAllowedHostParts`
# src/Symfony/Component/HtmlSanitizer/TextSanitizer/UrlSanitizer.phpprivatestaticfunctionmatchAllowedHostParts(array$uriParts, array$trustedParts): bool
{
// Check each chunk of the domain is validforeach ($trustedPartsas$key => $trustedPart) {
if ($uriParts[$key] !== $trustedPart) {
returnfalse;
}
}
returntrue;
}
when $trustedParts is longer than $uriParts. It eventually ends with a warning : Warning: Undefined array key 2.
How to reproduce
Here is a way to reproduce the issue through HtmlSanitizer unit tests :
Open src/Symfony/Component/HtmlSanitizer/Tests/TextSanitizer/UrlSanitizerTest.php
### Possible Solution
I would check that key exists before accessing it. Roughly :
```php
private static function matchAllowedHostParts(array $uriParts, array $trustedParts): bool
{
// Check each chunk of the domain is valid
foreach ($trustedParts as $key => $trustedPart) {
if (array_key_exists($key, $uriParts) && $uriParts[$key] !== $trustedPart) {
return false;
}
}
return true;
}
Symfony version(s) affected
6.1.0 and above
Description
Hello,
I'm getting an error when sanitizing a text with urls. I have multiple allowed hosts in my config, and thus html sanitization for urls fails with access to undefined keys when calling
UrlSanitizer->matchAllowedHostParts.Here are details about narrowing down the issue to `UrlSanitizer->matchAllowedHostParts`
This becomes quite obvious that when looking at `matchAllowedHostParts`when
$trustedPartsis longer than$uriParts. It eventually ends with a warning :Warning: Undefined array key 2.How to reproduce
Here is a way to reproduce the issue through HtmlSanitizer unit tests :
src/Symfony/Component/HtmlSanitizer/Tests/TextSanitizer/UrlSanitizerTest.phpUndefined array key 2
/home/stoakes/dev/symfony/src/Symfony/Component/HtmlSanitizer/TextSanitizer/UrlSanitizer.php:135
/home/stoakes/dev/symfony/src/Symfony/Component/HtmlSanitizer/TextSanitizer/UrlSanitizer.php:123
/home/stoakes/dev/symfony/src/Symfony/Component/HtmlSanitizer/TextSanitizer/UrlSanitizer.php:63
/home/stoakes/dev/symfony/src/Symfony/Component/HtmlSanitizer/Tests/TextSanitizer/UrlSanitizerTest.php:24
Additional Context
No response