From c70e26db31d520c554b867325ace95cbee6687e3 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Mon, 28 Sep 2020 19:46:31 +0300
Subject: [PATCH] validate url: feed urlencoded() URL to filter_var() only

---
 classes/urlhelper.php | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/classes/urlhelper.php b/classes/urlhelper.php
index 461d5fb7e..d7b7d004a 100644
--- a/classes/urlhelper.php
+++ b/classes/urlhelper.php
@@ -64,13 +64,6 @@ class UrlHelper {
 		if (!in_array(strtolower($tokens['scheme']), ['http', 'https']))
 			return false;
 
-		if ($tokens['path']) {
-			$tokens['path'] = implode("/",
-										array_map("rawurlencode",
-											array_map("rawurldecode",
-												explode("/", $tokens['path']))));
-		}
-
 		//convert IDNA hostname to punycode if possible
 		if (function_exists("idn_to_ascii")) {
 			if (mb_detect_encoding($tokens['host']) != 'ASCII') {
@@ -78,9 +71,21 @@ class UrlHelper {
 			}
 		}
 
+		// separate set of tokens with urlencoded 'path' because filter_var() rightfully fails on non-latin characters
+		// (used for validation only, we actually request the original URL, in case of urlencode breaking it)
+		$tokens_filter_var = $tokens;
+
+		if ($tokens['path']) {
+			$tokens_filter_var['path'] = implode("/",
+										array_map("rawurlencode",
+											array_map("rawurldecode",
+												explode("/", $tokens['path']))));
+		}
+
 		$url = self::build_url($tokens);
+		$url_filter_var = self::build_url($tokens_filter_var);
 
-		if (filter_var($url, FILTER_VALIDATE_URL) === false)
+		if (filter_var($url_filter_var, FILTER_VALIDATE_URL) === false)
 			return false;
 
 		if ($extended_filtering) {