Use trim and rawurlencode to prevent possible infinite loop. (#1602)

City-of-Helsinki · Dec 10, 2024 · fef6f63 · fef6f63
1 parent 6d6f508
commit fef6f63
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/...modules/custom/grants_handler/src/EventSubscriber/ForceCompanyAuthorisationSubscriber.php b/...modules/custom/grants_handler/src/EventSubscriber/ForceCompanyAuthorisationSubscriber.php
@@ -77,7 +77,7 @@ public function needsRedirectToLogin(RequestEvent $event): bool {
       return FALSE;
     }
     $requestUri = $event->getRequest()->getRequestUri();
-    $urlObject = Url::fromUserInput($requestUri);
+    $urlObject = Url::fromUserInput(trim(rawurldecode($requestUri)));
     if ($urlObject->access(User::getAnonymousUser()) === FALSE) {
       return TRUE;
     }
@@ -107,7 +107,8 @@ public function needsRedirectToMandate(RequestEvent $event): bool {
     if ($selectedCompany !== NULL) {
       return FALSE;
     }
-    $urlObject = Url::fromUserInput($event->getRequest()->getRequestUri());
+    $requestUri = $event->getRequest()->getRequestUri();
+    $urlObject = Url::fromUserInput(trim(rawurldecode($requestUri)));
     $routeName = $urlObject->getRouteName();
 
     $nodeType = '';