Skip to content

Calling urldecode() on image src in Html::parseImage() can break signed images #2141

Open
@petemcfarlane

Description

@petemcfarlane

Describe the Bug

PhpWord\Shared\Html::parseImage() calls urldecode($src) on the image before trying to fetch it. This breaks when I am using a pre-signed url, e.g.:

Steps to Reproduce

$src = 'https://assets.gatherpreview.com/MjU5MzE/dV0flVTVO1znlMqV?ar=1%3A1&fit=crop&w=200&s=33a048f664e983241664d6bceb11117b';

get_headers($src); // works ✅ 

$src = urldecode($src); // this subtly changes the %3A to a literal :
// https://assets.gatherpreview.com/MjU5MzE/dV0flVTVO1znlMqV?ar=1%3A1&fit=crop&w=200&s=33a048f664e983241664d6bceb11117b

get_headers($src); // now broken 🐛  because the pre-signed token expects the %3A rather than :

Expected Behavior

I'm not sure why it was decided to add a urldecode() in this commit originally. I've ran the HtmlTest case without the urldecode() and none of the tests break.

Current Behavior

It calls urldecode($src). What's more, the error message uses $originSrc, not $src, causing more confusion when debugging!

throw new \Exception("Could not load image $originSrc"); // should be $src, I think

Context

  • PHP Version: 8.0.10
  • PHPWord Version: 0.18.2

I'm happy to submit a one-line PR, provided others are happy for this to be removed?

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions