Allow only http(s) URLs; return '' for invalid input. */
($url)
| 89 | |
| 90 | /** Allow only http(s) URLs; return '' for invalid input. */ |
| 91 | private static function sanitizeHttpUrl($url): string |
| 92 | { |
| 93 | $url = trim((string)$url); |
| 94 | if ($url === '') { |
| 95 | return ''; |
| 96 | } |
| 97 | $valid = filter_var($url, FILTER_VALIDATE_URL); |
| 98 | if (!$valid) { |
| 99 | return ''; |
| 100 | } |
| 101 | $scheme = strtolower(parse_url($url, PHP_URL_SCHEME) ?: ''); |
| 102 | return ($scheme === 'http' || $scheme === 'https') ? $url : ''; |
| 103 | } |
| 104 | |
| 105 | /** Allow logo URLs that are either site-relative or http(s). */ |
| 106 | private static function sanitizeLogoUrl($url): string |
no outgoing calls
no test coverage detected