Filters::safeUrl() accepts Stringable

nette · Sep 13, 2023 · 0ae3566 · 0ae3566
1 parent bbc6174
commit 0ae3566
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 4 deletions.
diff --git a/src/Latte/Runtime/Filters.php b/src/Latte/Runtime/Filters.php
@@ -228,11 +228,11 @@ public static function convertHtmlToText(string $s): string
 	/**
 	 * Sanitizes string for use inside href attribute.
 	 */
-	public static function safeUrl(string|HtmlStringable $s): string
+	public static function safeUrl(string|\Stringable $s): string
 	{
-		if ($s instanceof HtmlStringable) {
-			$s = self::convertHtmlToText((string) $s);
-		}
+		$s = $s instanceof HtmlStringable
+			? self::convertHtmlToText((string) $s)
+			: (string) $s;
 
 		return preg_match('~^(?:(?:https?|ftp)://[^@]+(?:/.*)?|(?:mailto|tel|sms):.+|[/?#].*|[^:]+)$~Di', $s) ? $s : '';
 	}

diff --git a/tests/common/Safe.url.phpt b/tests/common/Safe.url.phpt
@@ -84,3 +84,22 @@ Assert::match(
 	'<img src="https://nette.org?a=1&amp;b=&lt;a&gt;">',
 	$latte->renderToString('{capture $url}https://nette.org?a=1&amp;b={="<a>"}{/capture}<img src="{$url}">'),
 );
+
+Assert::match(
+	'<img src="">',
+	$latte->renderToString('{capture $url}&#x6a;&#x61;vascript:foo{/capture}<img src="{$url}">'),
+);
+
+// accepts Stringable
+Assert::match(
+	'<img src="&lt;a&gt;">',
+	$latte->renderToString(
+		'<img src="{$url}">',
+		['url' => new class {
+			public function __toString()
+			{
+				return '<a>';
+			}
+		}],
+	),
+);