Skip to content

Escape username and password in UrlSanitizer#full_url

Stan Hu requested to merge sh-normalize-urls into master

If a user uses a password with certain characters (e.g. /, #, +, etc.) UrlSanitizer#full_url will generate an invalid URL that cannot be parsed properly by Addressable::URI. If used with UrlBlocker, this will be flagged as an invalid URI.

Related discussion: https://github.com/sporkmonger/addressable/issues/42

Edited by Stan Hu

Merge request reports