Compare commits

..

3 Commits

3 changed files with 8 additions and 3 deletions

View File

@ -44,7 +44,7 @@ final class MD_STD {
public static function realpath(string $path):string { public static function realpath(string $path):string {
$output = \realpath($path); $output = \realpath($path);
if (!\is_string($output) || empty($output)) { if (!\is_string($output)) {
throw new MDFileDoesNotExist("The file {$path} does not exist or is not readable."); throw new MDFileDoesNotExist("The file {$path} does not exist or is not readable.");
} }
return $output; return $output;

View File

@ -202,6 +202,11 @@ final class MD_STD_IN {
throw new MDInvalidUrl("Invalid input URL"); throw new MDInvalidUrl("Invalid input URL");
} }
// Check for valid schemes
if (MD_STD::startsWithAny($input, ['https://', 'http://', 'ftp://']) === false) {
throw new MDInvalidUrl("Invalid input URL");
}
return $output; return $output;
} }

View File

@ -134,8 +134,8 @@ final class MD_STD_SEC {
/** /**
* Send CSP headers. * Send CSP headers.
* *
* @param array{default-src: string, connect-src: string, script-src: string, img-src: string, media-src: string, style-src: string, frame-src: string, object-src: string, base-uri: string, form-action: string, frame-ancestors?: string} $directives Directives to send. Font source is always set to 'self', and hence excluded. * @param array{default-src: string, connect-src: string, script-src: string, img-src: string, media-src: string, style-src: string, frame-src: string, object-src: string, base-uri: string, form-action: string, worker-src?: string, frame-ancestors?: string} $directives Directives to send. Font source is always set to 'self', and hence excluded.
* @param string $frame_ancestors Frame ancestors directive. Default is to not set it. * @param string $frame_ancestors Frame ancestors directive. Default is to not set it.
* *
* @return void * @return void
*/ */