diff --git a/src/Http/Middleware/VerifyRedirectUrl.php b/src/Http/Middleware/VerifyRedirectUrl.php index 3dd6cc9f..23cf6312 100644 --- a/src/Http/Middleware/VerifyRedirectUrl.php +++ b/src/Http/Middleware/VerifyRedirectUrl.php @@ -20,7 +20,9 @@ public function handle($request, Closure $next) { $redirect = $request->get('redirect'); - if ($redirect && parse_url($redirect)['host'] !== $request->getHost()) { + $url = parse_url($redirect); + + if ($redirect && (! isset($url['host']) || $url['host'] !== $request->getHost())) { throw new AccessDeniedHttpException('Redirect host mismatch.'); } diff --git a/tests/Unit/VerifyRedirectUrlTest.php b/tests/Unit/VerifyRedirectUrlTest.php index 77524ae7..a7a953f7 100644 --- a/tests/Unit/VerifyRedirectUrlTest.php +++ b/tests/Unit/VerifyRedirectUrlTest.php @@ -33,6 +33,18 @@ public function test_it_fails_on_host_mismatch() }); } + public function test_it_fails_when_the_url_is_invalid() + { + $request = Request::create('http://baz.com/stripe/payment', 'GET', ['redirect' => 'foo/bar']); + $middleware = new VerifyRedirectUrl; + + $this->expectException(AccessDeniedHttpException::class); + + $middleware->handle($request, function () { + // + }); + } + public function test_it_is_skipped_when_no_redirect_is_present() { $request = Request::create('http://baz.com/stripe/payment', 'GET');