MDL-86544 lib: Adjust checks on local URL params

2025-11-27 11:51:17 +00:00
parent 48031a9e52
commit 021406c8b8
1 changed files with 4 additions and 2 deletions
@@ -1041,8 +1041,10 @@ enum param: string {
                // Absolute, and matches our wwwroot.
            } else {
                // Relative - let's make sure there are no tricks.
-                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
-                        !preg_match('/javascript(?:.*\/{2,})?:/i', rawurldecode($param))) {
+                if (
+                    validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
+                    !preg_match('/\bjavascript\b[\s\S]*?(?:\:|\/)/i', rawurldecode($param))
+                ) {
                    // Valid relative local URL.
                } else {
                    $param = '';