RequestFactory: invalid byte sequences in path are not silently disca…

…rded
nette · Dec 16, 2014 · 563c85a · 563c85a
1 parent 88784b1
commit 563c85a
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/Http/RequestFactory.php b/src/Http/RequestFactory.php
@@ -100,7 +100,10 @@ public function createHttpRequest()
 
 		// normalized url
 		$url->canonicalize();
-		$url->setPath(Strings::fixEncoding($url->getPath()));
+
+		if (preg_match(self::NONCHARS, $url->getPath()) || preg_last_error()) {
+			throw new InvalidRequestException(); // TODO!
+		}
 
 		// detect script path
 		if (isset($_SERVER['SCRIPT_NAME'])) {