Strip invalid characters from referer URLs

2020-03-15 17:37:51 -04:00 · 2020-03-15 17:37:51 -04:00 · 4011a113cc
parent 70cbe91776
commit 4011a113cc
1 changed files with 1 additions and 1 deletions
--- a/src/invidious/helpers/utils.cr
+++ b/src/invidious/helpers/utils.cr
@ -316,7 +316,7 @@ def get_referer(env, fallback = "/", unroll = true)
  end

  referer = referer.full_path
-  referer = "/" + referer.lstrip("/\\")
+  referer = "/" + referer.gsub(/[^\/?@&%=\-_.0-9a-zA-Z]/, "").lstrip("/\\")

  if referer == env.request.path
    referer = fallback