Compare commits

..

3 Commits

3 changed files with 8 additions and 3 deletions

View File

@ -44,7 +44,7 @@ final class MD_STD {
public static function realpath(string $path):string {
$output = \realpath($path);
if (!\is_string($output) || empty($output)) {
if (!\is_string($output)) {
throw new MDFileDoesNotExist("The file {$path} does not exist or is not readable.");
}
return $output;

View File

@ -202,6 +202,11 @@ final class MD_STD_IN {
throw new MDInvalidUrl("Invalid input URL");
}
// Check for valid schemes
if (MD_STD::startsWithAny($input, ['https://', 'http://', 'ftp://']) === false) {
throw new MDInvalidUrl("Invalid input URL");
}
return $output;
}

View File

@ -134,7 +134,7 @@ final class MD_STD_SEC {
/**
* Send CSP headers.
*
* @param array{default-src: string, connect-src: string, script-src: string, img-src: string, media-src: string, style-src: string, frame-src: string, object-src: string, base-uri: string, form-action: string, frame-ancestors?: string} $directives Directives to send. Font source is always set to 'self', and hence excluded.
* @param array{default-src: string, connect-src: string, script-src: string, img-src: string, media-src: string, style-src: string, frame-src: string, object-src: string, base-uri: string, form-action: string, worker-src?: string, frame-ancestors?: string} $directives Directives to send. Font source is always set to 'self', and hence excluded.
* @param string $frame_ancestors Frame ancestors directive. Default is to not set it.
*
* @return void