Handle \t as well

pshoukry · Apr 13, 2023 · fe3948f · fe3948f
1 parent c071506
commit fe3948f
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/lib/phoenix/controller.ex b/lib/phoenix/controller.ex
@@ -506,7 +506,7 @@ defmodule Phoenix.Controller do
     end
   end
 
-  @invalid_local_url_chars ["\\", "\%"]
+  @invalid_local_url_chars ["\\", "/%", "/\t"]
   defp validate_local_url("//" <> _ = to), do: raise_invalid_url(to)
 
   defp validate_local_url("/" <> _ = to) do

diff --git a/test/phoenix/controller/controller_test.exs b/test/phoenix/controller/controller_test.exs
@@ -386,6 +386,10 @@ defmodule Phoenix.Controller.ControllerTest do
       assert_raise ArgumentError, ~r/unsafe/, fn ->
         redirect(conn(:get, "/"), to: "/%09/example.com")
       end
+
+      assert_raise ArgumentError, ~r/unsafe/, fn ->
+        redirect(conn(:get, "/"), to: "/\t/example.com")
+      end
     end
 
     test "with :external" do