Escape special characters in Varnish::banPath() host patterns

jdreesen · jdreesen · commit 288df3718ba3 · 2025-06-16T17:31:29.000+02:00
diff --git a/src/ProxyClient/Varnish.php b/src/ProxyClient/Varnish.php
@@ -107,7 +107,7 @@ public function banPath($path, $contentType = null, $hosts = null)
             if (!count($hosts)) {
                 throw new InvalidArgumentException('Either supply a list of hosts or null, but not an empty array.');
             }
-            $hosts = '^('.implode('|', $hosts).')$';
+            $hosts = '^('.implode('|', array_map('preg_quote', $hosts)).')$';
         }
 
         $headers = [

Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,7 @@ public function banPath($path, $contentType = null, $hosts = null)`
`107`	`107`	`if (!count($hosts)) {`
`108`	`108`	`throw new InvalidArgumentException('Either supply a list of hosts or null, but not an empty array.');`
`109`	`109`	`}`
`110`		`- $hosts = '^('.implode('\|', $hosts).')$';`
	`110`	`+ $hosts = '^('.implode('\|', array_map('preg_quote', $hosts)).')$';`
`111`	`111`	`}`
`112`	`112`
`113`	`113`	`$headers = [`