tiennm99/coolify
1
0
Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-08-20 06:23:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(github): reject malformed app URL origins

Browse Source
This commit is contained in:
Andras Bacsai
2026-07-07 12:24:52 +02:00
parent 1adeed2a48
commit 21bd8fa2bc
3 changed files with 43 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap/helpers/github.php
+9 -8
View File
@@ -38,22 +38,23 @@ function githubUrlHost(?string $url): ?string
/**
* Build the scheme://host[:port] origin for a GitHub URL.
*
* When the host cannot be parsed (e.g. a scheme-less or malformed URL such as
* "not-a-url"), the input is returned verbatim with any trailing slashes
* trimmed. Callers should pass already-validated URLs (see SafeExternalUrl),
* so this fallback only guards against unexpected input.
* This helper fails explicitly for blank, scheme-less, or malformed input when
* githubUrlHost() cannot parse a host, because returning the original input
* would not be a valid origin. Callers should pass already-validated URLs.
*
* @param string $url The URL to derive the origin from
* @return string The normalized origin, or the trimmed input when the host is unparseable
* @return string The normalized origin
*
* @throws InvalidArgumentException When the URL does not contain a parseable scheme and host
*/
function githubUrlOrigin(string $url): string
{
$scheme = parse_url($url, PHP_URL_SCHEME) ?: 'https';
$scheme = parse_url($url, PHP_URL_SCHEME);
$host = githubUrlHost($url);
$port = parse_url($url, PHP_URL_PORT);
if (! $host) {
return rtrim($url, '/');
if (! is_string($scheme) || blank($scheme) || ! $host) {
throw new InvalidArgumentException('GitHub URL must include a valid scheme and host.');
}
return $scheme.'://'.$host.($port ? ":{$port}" : '');