From 0ae356635c1e964576c9c6db972163a5ba3f5002 Mon Sep 17 00:00:00 2001
From: David Grudl <david@grudl.com>
Date: Wed, 13 Sep 2023 15:07:29 +0200
Subject: [PATCH] Filters::safeUrl() accepts Stringable

---
 src/Latte/Runtime/Filters.php |  8 ++++----
 tests/common/Safe.url.phpt    | 19 +++++++++++++++++++
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/src/Latte/Runtime/Filters.php b/src/Latte/Runtime/Filters.php
index 503e3067f..90a727188 100644
--- a/src/Latte/Runtime/Filters.php
+++ b/src/Latte/Runtime/Filters.php
@@ -228,11 +228,11 @@ public static function convertHtmlToText(string $s): string
 	/**
 	 * Sanitizes string for use inside href attribute.
 	 */
-	public static function safeUrl(string|HtmlStringable $s): string
+	public static function safeUrl(string|\Stringable $s): string
 	{
-		if ($s instanceof HtmlStringable) {
-			$s = self::convertHtmlToText((string) $s);
-		}
+		$s = $s instanceof HtmlStringable
+			? self::convertHtmlToText((string) $s)
+			: (string) $s;
 
 		return preg_match('~^(?:(?:https?|ftp)://[^@]+(?:/.*)?|(?:mailto|tel|sms):.+|[/?#].*|[^:]+)$~Di', $s) ? $s : '';
 	}
diff --git a/tests/common/Safe.url.phpt b/tests/common/Safe.url.phpt
index 95228c091..ff7a3ebe4 100644
--- a/tests/common/Safe.url.phpt
+++ b/tests/common/Safe.url.phpt
@@ -84,3 +84,22 @@ Assert::match(
 	'<img src="https://nette.org?a=1&amp;b=&lt;a&gt;">',
 	$latte->renderToString('{capture $url}https://nette.org?a=1&amp;b={="<a>"}{/capture}<img src="{$url}">'),
 );
+
+Assert::match(
+	'<img src="">',
+	$latte->renderToString('{capture $url}&#x6a;&#x61;vascript:foo{/capture}<img src="{$url}">'),
+);
+
+// accepts Stringable
+Assert::match(
+	'<img src="&lt;a&gt;">',
+	$latte->renderToString(
+		'<img src="{$url}">',
+		['url' => new class {
+			public function __toString()
+			{
+				return '<a>';
+			}
+		}],
+	),
+);