ReturnUrlPolicy
in package
FinalYes
Policy for payment return URLs (`successUrl` / `cancelUrl` / `notifyUrl`), which come from the caller of `Payment:create`, are stored with the payment and go straight into the HTTP `Location` after the return from the gateway.
IMPORTANT: comparing only the parse_url() host is not enough. The host is null also for
javascript:alert(1), data:text/html,x, mailto:... or https:evil.example, so all of
them would look "relative" and pass, giving an open redirect or script URL.
Rule (positive allowlist, not a scheme deny-list):
- a relative path starting with exactly one
/(not//host, not/\host), or - an absolute URL
scheme://host[:port]/...where the scheme ishttpsor the scheme of the current request (a localphp -Sruns on http), host and port match the current request and there are no credentials; - never control characters (CR/LF: header injection) or a backslash (browsers read it as
/).
For anything else the caller substitutes the server default.
Table of Contents
Methods
- isAllowed() : bool
Methods
isAllowed()
public
static isAllowed(mixed $url, string $currentScheme, string $currentHost[, int|null $currentPort = null ]) : bool
Parameters
- $url : mixed
- $currentScheme : string
- $currentHost : string
- $currentPort : int|null = null