Fix: Prevent phar:// paths from leaking to frontend assets and strictly validate URLs (#7)

Author: Ezar101

.gitignore

@@ -9,3 +9,4 @@ litedocs.phar
 composer.lock
 /bin/litedocs.phar
 .php-cs-fixer.cache
+box.phar

box.json

@@ -2,7 +2,7 @@
     "main": "bin/litedocs",
     "output": "litedocs.phar",
     "directories": ["src", "config", "vendor"],
-    "files": ["composer.json", "composer.lock"],
+    "files": ["composer.json", "composer.lock", "LICENSE", "README.md"],
     "compression": "GZ",
     "chmod": "0755"
 }

src/Core/Kernel.php

@@ -20,7 +20,7 @@
 
 class Kernel
 {
-    public const string VERSION = '1.0.3';
+    public const string VERSION = '1.0.4';
 
     private array $config;
 
@@ -321,13 +321,17 @@ private function createRedirectPage(string $path, string $target): void
 
     private function processAsset(string $assetPath, string $siteDir, string $rootPath): string
     {
-        if (filter_var($assetPath, FILTER_VALIDATE_URL)) {
+        // if (filter_var($assetPath, FILTER_VALIDATE_URL)) {
+        //     return $assetPath;
+        // }
+
+        if (str_starts_with($assetPath, 'http://') || str_starts_with($assetPath, 'https://') || str_starts_with($assetPath, '//')) {
             return $assetPath;
         }
 
         if (!file_exists($assetPath)) {
-            trigger_error("Asset not found: $assetPath", E_USER_WARNING);
-            return $assetPath;
+            trigger_error("Asset not found (excluded from build?): $assetPath", E_USER_WARNING);
+            return '';
         }
 
         $extension = pathinfo($assetPath, PATHINFO_EXTENSION);