Do not decode %2F in path

amphp · Jul 3, 2024 · a9be25b · a9be25b
1 parent c0434ad
commit a9be25b
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/src/Router.php b/src/Router.php
@@ -74,7 +74,9 @@ public function handleRequest(Request $request): Response
         }
 
         $method = $request->getMethod();
-        $path = \rawurldecode($request->getUri()->getPath());
+
+        $path = \str_ireplace('%2F', '%252F', $request->getUri()->getPath());
+        $path = \rawurldecode($path);
 
         $toMatch = "{$method}\0{$path}";
 
@@ -113,6 +115,12 @@ public function handleRequest(Request $request): Response
         }
     }
 
+    private function decode(string $path): string
+    {
+        $path = \str_ireplace('%2F', '%252F', $path);
+        return \rawurldecode($path);
+    }
+
     /**
      * Merge another router's routes into this router.
      *

diff --git a/test/RouterTest.php b/test/RouterTest.php
@@ -214,11 +214,11 @@ public function testPathIsMatchedDecoded(): void
         });
 
         $router = new Router($this->server, $this->testLogger, $this->errorHandler);
-        $router->addRoute("GET", "/fo+ö", $requestHandler);
+        $router->addRoute("GET", "/fo+%2Fö bar", $requestHandler);
 
         $this->server->start($router, $this->errorHandler);
 
-        $uri = "/fo+" . \rawurlencode("ö");
+        $uri = "/fo+%2F" . \rawurlencode("ö ") . 'bar';
 
         $request = new Request($this->createMock(Client::class), "GET", Uri\Http::createFromString($uri));
         $response = $router->handleRequest($request);