Encoding user input in path

recurly · Feb 28, 2020 · ec4ebf4 · ec4ebf4
1 parent 15d2e91
commit ec4ebf4
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/lib/recurly/base_client.php b/lib/recurly/base_client.php
@@ -128,7 +128,7 @@ protected function interpolatePath(string $path, array $options = []): string
     {
         return array_reduce(
             array_keys($options), function ($p, $i) use ($options) {
-                return str_replace("{{$i}}", $options[$i], $p);
+                return str_replace("{{$i}}", rawurlencode($options[$i]), $p);
             }, $path
         );
     }

diff --git a/phpunit.xml.dist b/phpunit.xml.dist
@@ -17,8 +17,11 @@
         <whitelist processUncoveredFilesFromWhitelist="true">
             <directory suffix=".php">lib</directory>
             <exclude>
-                <directory suffix=".php">lib/recurly/resources</directory>
+                <file>lib/recurly.php</file>
+                <file>lib/recurly/version.php</file>
                 <file>lib/recurly/client.php</file>
+                <directory suffix=".php">lib/recurly/resources</directory>
+                <directory suffix=".php">lib/recurly/errors</directory>
             </exclude>
         </whitelist>
     </filter>