Fix for invalid Jackrabbit characters in URLs (#436)

* Remove routes with invalid PHPCR characters

* Disallow URLs with spaces adjacent to slashes

Author: UFTimmy

src/Doctrine/Phpcr/PrefixCandidates.php

@@ -118,7 +118,7 @@ public function getCandidates(Request $request)
 
         // filter out things like double // or trailing / - this would trigger an exception on the document manager.
         foreach ($candidates as $key => $candidate) {
-            if (!PathHelper::assertValidAbsolutePath($candidate, false, false)) {
+            if (!$this->isCandidateValid($candidate)) {
                 unset($candidates[$key]);
             }
         }
@@ -166,6 +166,30 @@ public function setManagerName($manager)
         $this->managerName = $manager;
     }
 
+    /**
+     * @param string $candidate The candidate path to check
+     *
+     * @return bool
+     */
+    protected function isCandidateValid($candidate)
+    {
+        // Candidates cannot start or end with a space in Jackrabbit.
+        if (' ' === \substr($candidate, 0, 1) || ' ' === \substr($candidate, -1)) {
+            return false;
+        }
+
+        // Jackrabbit does not allow spaces before or after the path separator.
+        if (false !== \strpos($candidate, ' /') || false !== \strpos($candidate, '/ ')) {
+            return false;
+        }
+
+        if (!PathHelper::assertValidAbsolutePath($candidate, false, false)) {
+            return false;
+        }
+
+        return true;
+    }
+
     /**
      * {@inheritdoc}
      *

src/Doctrine/Phpcr/RouteProvider.php

@@ -64,8 +64,11 @@ public function __construct(
      */
     public function getCandidates(Request $request)
     {
-        if (false !== strpos($request->getPathInfo(), ':')) {
-            return [];
+        $invalidCharacters = [':', '[', ']'];
+        foreach ($invalidCharacters as $invalidCharacter) {
+            if (false !== strpos($request->getPathInfo(), $invalidCharacter)) {
+                return [];
+            }
         }
 
         return $this->candidatesStrategy->getCandidates($request);