From 7b6bc41d5b7068c5b848de3fec685a6359ebe827 Mon Sep 17 00:00:00 2001 From: Chris Stayte Date: Tue, 21 Oct 2025 20:02:40 -0400 Subject: [PATCH 1/2] remove % from forbidden characters in git URLs --- app/Rules/ValidGitRepositoryUrl.php | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/app/Rules/ValidGitRepositoryUrl.php b/app/Rules/ValidGitRepositoryUrl.php index ba1aed11b..988f7d143 100644 --- a/app/Rules/ValidGitRepositoryUrl.php +++ b/app/Rules/ValidGitRepositoryUrl.php @@ -31,7 +31,7 @@ class ValidGitRepositoryUrl implements ValidationRule $dangerousChars = [ ';', '|', '&', '$', '`', '(', ')', '{', '}', '[', ']', '<', '>', '\n', '\r', '\0', '"', "'", - '\\', '!', '?', '*', '^', '%', '=', '+', + '\\', '!', '?', '*', '^', '=', '+', '#', // Comment character that could hide commands ]; @@ -85,11 +85,17 @@ class ValidGitRepositoryUrl implements ValidationRule } // Validate SSH URL format (git@host:user/repo.git) - if (! preg_match('/^git@[a-zA-Z0-9\.\-]+:[a-zA-Z0-9\-_\/\.~]+$/', $value)) { + if (! preg_match('/^git@[a-zA-Z0-9\.\-]+:[a-zA-Z0-9\-_\/\.~%]+$/', $value)) { $fail('The :attribute is not a valid SSH repository URL.'); return; } + + // Ensure any percent signs are valid percent-encodings like %20 + if (! empty($path) && preg_match('/%(?![0-9A-Fa-f]{2})/', $path)) { + $fail('The :attribute path contains invalid percent encoding.'); + return; + } } elseif (str_starts_with($value, 'http://') || str_starts_with($value, 'https://')) { // Validate HTTP(S) URL if (! filter_var($value, FILTER_VALIDATE_URL)) { From ec9672ec686778b282fc2623b2cd90f17b430e1e Mon Sep 17 00:00:00 2001 From: Chris Stayte Date: Tue, 21 Oct 2025 20:07:03 -0400 Subject: [PATCH 2/2] Updated from $path to $value --- app/Rules/ValidGitRepositoryUrl.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Rules/ValidGitRepositoryUrl.php b/app/Rules/ValidGitRepositoryUrl.php index 988f7d143..243c1f390 100644 --- a/app/Rules/ValidGitRepositoryUrl.php +++ b/app/Rules/ValidGitRepositoryUrl.php @@ -92,7 +92,7 @@ class ValidGitRepositoryUrl implements ValidationRule } // Ensure any percent signs are valid percent-encodings like %20 - if (! empty($path) && preg_match('/%(?![0-9A-Fa-f]{2})/', $path)) { + if (! empty($value) && preg_match('/%(?![0-9A-Fa-f]{2})/', $value)) { $fail('The :attribute path contains invalid percent encoding.'); return; }