tito10047 / php-calendar / 36228306250

89%

main: 87%

Build Type

Pull #5

github

Committed by tito10047

Commit Message

fix(caldav): an encoded slash belongs to the segment it sits in

segmentsOf() decoded the whole path and then split on "/", so a "%2f"
inside a segment became a delimiter and one segment silently became two
— and with a framework router in front that has already decoded once,
"%252f" does the same. RFC 3986 reads the other way round: a slash
delimits only when it is not percent-encoded.

Split first, decode each segment after. Nothing in this router addresses
anything positional or file-shaped today, so it was latent rather than
exploitable; it is the class of bug that stops being latent the moment a
segment starts naming a path.

Pull Request Pull Request #5: Feature caldav server

Coverage Stats

1988 of 2241 new or added lines in 34 files covered. (88.71%)

1 existing line in 1 file now uncovered.

2032 of 2294 relevant lines covered (88.58%)

14.13 hits per line