Strip invalid characters from referer URLs

5 years ago · 4011a113cc
parent 70cbe91776
commit 4011a113cc
1 changed files with 1 additions and 1 deletions
--- a/src/invidious/helpers/utils.cr
+++ b/src/invidious/helpers/utils.cr
@ -316,7 +316,7 @@ def get_referer(env, fallback = "/", unroll = true)
  end
  referer = referer.full_path
-  referer = "/" + referer.lstrip("/\\")
+  referer = "/" + referer.gsub(/[^\/?@&%=\-_.0-9a-zA-Z]/, "").lstrip("/\\")
  if referer == env.request.path
    referer = fallback