revert URL sanitization changes

Author: dannyvankooten

assets/js/src/boxzilla/box.js

@@ -95,12 +95,14 @@ Box.prototype.events = function () {
           break;
         }
       }
-  }, false)
+  })
 
   this.element.addEventListener('submit', (evt) => {
-    box.setCookie(this.config.cookie.dismissed)
+    if (this.config.cookie && this.config.cookie.dismissed) {
+      box.setCookie(this.config.cookie.dismissed)
+    }
     box.fireEvent('box.interactions.form', [box, evt.target])
-  }, false)
+  })
 
   this.overlay.addEventListener('click', (evt) => {
     const x = evt.offsetX

src/admin/class-admin.php

@@ -530,7 +530,21 @@ public function sanitize_settings($opts)
      */
     public function sanitize_url($url_string)
     {
-        return \boxzilla_normalize_relative_url($url_string);
+        // if empty, just return a slash
+        if (empty($url_string)) {
+            return '/';
+        }
+
+        // if string looks like an absolute URL, extract just the path
+        if (preg_match('/^((https|http)?\:\/\/)?(\w+\.)?\w+\.\w+\.*/i', $url_string)) {
+            // make sure URL has scheme prepended, to make parse_url() understand..
+            $url_string = 'https://' . str_replace([ 'http://', 'https://' ], '', $url_string);
+
+            // get just the path
+            $url_string = parse_url($url_string, PHP_URL_PATH);
+        }
+        
+        return $url_string;
     }
 
     /**

src/class-loader.php

@@ -112,7 +112,7 @@ protected function match_patterns($string, array $patterns, $contains = false)
      */
     protected function get_request_url()
     {
-        return \boxzilla_normalize_relative_url(isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/');
+        return rtrim($_SERVER['REQUEST_URI'] ?? '', '/');
     }
 
     /**

src/functions.php

@@ -20,67 +20,3 @@ function boxzilla()
     return $instance;
 }
 
-/**
- * Normalize a relative URL for Boxzilla rule storage and matching.
- *
- * @param string $url_string
- *
- * @return string
- */
-function boxzilla_normalize_relative_url($url_string)
-{
-    $url_string = trim((string) $url_string);
-    if ($url_string === '') {
-        return '/';
-    }
-
-    if (strpos($url_string, '//') === 0) {
-        $url_string = 'https:' . $url_string;
-    } elseif (preg_match('/^[\w.-]+\.[a-z]{2,}(?:[\/?#]|$)/i', $url_string)) {
-        $url_string = 'https://' . $url_string;
-    }
-
-    $parts = wp_parse_url($url_string);
-    if (! is_array($parts)) {
-        return '/';
-    }
-
-    $path = isset($parts['path']) ? $parts['path'] : '/';
-    $path = '/' . ltrim((string) $path, '/');
-    $path = untrailingslashit($path);
-    if ($path === '') {
-        $path = '/';
-    }
-
-    if (empty($parts['query'])) {
-        return $path;
-    }
-
-    parse_str($parts['query'], $query_args);
-    if (empty($query_args)) {
-        return $path;
-    }
-
-    $tracking_keys = [
-        '_ga',
-        '_gl',
-        'dclid',
-        'fbclid',
-        'gclid',
-        'mc_cid',
-        'mc_eid',
-        'msclkid',
-    ];
-
-    foreach (array_keys($query_args) as $key) {
-        if (strpos($key, 'utm_') === 0 || in_array($key, $tracking_keys, true)) {
-            unset($query_args[ $key ]);
-        }
-    }
-
-    if (empty($query_args)) {
-        return $path;
-    }
-
-    return $path . '?' . build_query($query_args);
-}