Skip to content

Commit 98fda81

Browse files
committed
docs: Adds CHANGELOG entries detailing new and modified tests
1 parent 98fff9c commit 98fda81

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

CHANGELOG.md

+11
Original file line numberDiff line numberDiff line change
@@ -1 +1,12 @@
11
# Change Log
2+
3+
## Added
4+
5+
- Adds `UriIntegrationTest::testGetPathNormalizesMultipleLeadingSlashesToSingleSlashToPreventXSS()`, `UriIntegrationTest::testStringRepresentationWithMultipleSlashes(array $test)`, and `RequestIntegrationTest::testGetRequestTargetInOriginFormNormalizesUriWithMultipleLeadingSlashesInPath()`.
6+
These validate that a path containing multiple leading slashes is (a) represented with a single slash when calling `UriInterface::getPath()`, and (b) represented without changes when calling `UriInterface::__toString()`, including when calling `RequestInterface::getRequestTarget()` (which returns the path without the URI authority by default, to comply with origin-form).
7+
This is done to validate mitigations for [CVE-2015-3257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3257).
8+
9+
## Changed
10+
11+
- Modifies `UriIntegrationTest::testPathWithMultipleSlashes()` to only validate multiple slashes in the middle of a path.
12+
Multiple leading slashes are covered with the newly introduced tests.

0 commit comments

Comments
 (0)