瀏覽代碼

Prevent local URIs

Jordi Boggiano 12 年之前
父節點
當前提交
e52a4c9ded
共有 1 個文件被更改,包括 5 次插入0 次删除
  1. 5 0
      src/Packagist/WebBundle/Entity/Package.php

+ 5 - 0
src/Packagist/WebBundle/Entity/Package.php

@@ -288,6 +288,11 @@ class Package
      */
     public function setRepository($repository)
     {
+        // prevent local filesystem URLs
+        if (preg_match('{^(\.|[a-z]:|/)}i', $repository)) {
+            return;
+        }
+
         $this->repository = $repository;
 
         // avoid user@host URLs