diff --git a/core/lib/Drupal/Core/EventSubscriber/RedirectLeadingSlashes.php b/core/lib/Drupal/Core/EventSubscriber/RedirectLeadingSlashes.php index 593eaed..41f6377 100644 --- a/core/lib/Drupal/Core/EventSubscriber/RedirectLeadingSlashes.php +++ b/core/lib/Drupal/Core/EventSubscriber/RedirectLeadingSlashes.php @@ -25,13 +25,19 @@ class RedirectLeadingSlashes implements EventSubscriberInterface { */ public function redirect(GetResponseEvent $event) { $request = $event->getRequest(); - $request_uri = $request->getRequestUri(); + // Get the requested path minus the base path. + $path = $request->getPathInfo(); + // It is impossible to create a link or a route to a path starting with // leading slashes. However if a form is added to the 404 page that submits // back to the same URI this presents an open redirect vulnerability. - if (strpos($request_uri, '//') === 0) { - $request_uri = '/' . ltrim($request_uri, '/'); - $event->setResponse(new RedirectResponse($request->getUriForPath($request_uri))); + if (strpos($path, '//') === 0) { + $path = '/' . ltrim($path, '/'); + $qs = $request->getQueryString(); + if ($qs) { + $qs = '?' . $qs; + } + $event->setResponse(new RedirectResponse($request->getUriForPath($path) . $qs)); } } diff --git a/core/modules/system/src/Tests/Routing/RouterTest.php b/core/modules/system/src/Tests/Routing/RouterTest.php index e8a46ff..b945676 100644 --- a/core/modules/system/src/Tests/Routing/RouterTest.php +++ b/core/modules/system/src/Tests/Routing/RouterTest.php @@ -258,13 +258,14 @@ public function testLeadingSlashes() { $url = $request->getUriForPath('//router_test/test1'); $this->drupalGet($url); $this->assertEqual(1, $this->redirectCount, $url . " redirected to " . $this->url); - $this->assertUrl($this->container->get('url_generator')->generateFromPath('router_test/test1')); + $this->assertUrl($request->getUriForPath('/router_test/test1')); - // It should not matter how many leading slashes are used. - $url = $request->getUriForPath('/////////////////////////////////////////////////router_test/test1'); + // It should not matter how many leading slashes are used and query strings + // should be preserved. + $url = $request->getUriForPath('/////////////////////////////////////////////////router_test/test1') . '?qs=test'; $this->drupalGet($url); $this->assertEqual(1, $this->redirectCount, $url . " redirected to " . $this->url); - $this->assertUrl($this->container->get('url_generator')->generateFromPath('router_test/test1')); + $this->assertUrl($request->getUriForPath('/router_test/test1') . '?qs=test'); } }