fix: Destination URLs are no longer URL decoded _unless_ a malicious payload was stripped from them ([#330](#330))

Author: khalwat

src/helpers/UrlHelper.php

@@ -138,9 +138,11 @@ public static function mergeUrlWithPath($url, $path): string
      */
     public static function sanitizeUrl(string $url): string
     {
+        $originalUrl = $url;
         // HTML decode the entities, then strip out any tags
         $url = html_entity_decode($url, ENT_NOQUOTES, 'UTF-8');
         $url = urldecode($url);
+        $decodedUrl = $url;
         $url = strip_tags($url);
         // Remove any Twig tags that somehow are present in the incoming URL
         /** @noinspection CallableParameterUseCaseInTypeContextInspection */
@@ -153,7 +155,10 @@ public static function sanitizeUrl(string $url): string
             ]
             , '', $url
         );
-
+        // If the URL didn't have anything stripped from it, us the original encoded URL
+        if ($url === $decodedUrl) {
+            $url = $originalUrl;
+        }
         return $url;
     }
 }