Escape special characters in Varnish::banPath() host patterns

jdreesen · jdreesen · commit 44abf4017033 · 2025-06-17T10:02:37.000+02:00
diff --git a/src/ProxyClient/Varnish.php b/src/ProxyClient/Varnish.php
@@ -110,7 +110,7 @@ public function banPath(string $path, ?string $contentType = null, array|string|
             if (!count($hosts)) {
                 throw new InvalidArgumentException('Either supply a list of hosts or null, but not an empty array.');
             }
-            $hosts = '^('.implode('|', $hosts).')$';
+            $hosts = '^('.implode('|', array_map('preg_quote', $hosts)).')$';
         }
 
         $headers = [

Original file line number	Diff line number	Diff line change
`@@ -110,7 +110,7 @@ public function banPath(string $path, ?string $contentType = null, array\|string\|`
`110`	`110`	`if (!count($hosts)) {`
`111`	`111`	`throw new InvalidArgumentException('Either supply a list of hosts or null, but not an empty array.');`
`112`	`112`	`}`
`113`		`- $hosts = '^('.implode('\|', $hosts).')$';`
	`113`	`+ $hosts = '^('.implode('\|', array_map('preg_quote', $hosts)).')$';`
`114`	`114`	`}`
`115`	`115`
`116`	`116`	`$headers = [`