Request::getOrigin() accepts only URL as defined in RFC 6454

Author: dg

src/Http/Request.php

@@ -212,14 +212,11 @@ public function getReferer(): ?UrlImmutable
 	 */
 	public function getOrigin(): ?UrlImmutable
 	{
-		$header = $this->headers['origin'] ?? 'null';
-		try {
-			return $header === 'null'
-				? null
-				: new UrlImmutable($header);
-		} catch (Nette\InvalidArgumentException) {
+		$header = $this->headers['origin'] ?? '';
+		if (!preg_match('~^[a-z][a-z0-9+.-]*://[^/]+$~i', $header)) {
 			return null;
 		}
+		return new UrlImmutable($header);
 	}
 
 

tests/Http/Request.getOrigin.phpt

@@ -27,3 +27,11 @@ test('valid Origin header', function () {
 	]);
 	Assert::equal(new UrlImmutable('https://nette.org'), $request->getOrigin());
 });
+
+
+test('invalid Origin header', function () {
+	$request = new Http\Request(new Http\UrlScript, headers: [
+		'Origin' => 'https://nette.org/path',
+	]);
+	Assert::null($request->getOrigin());
+});