Patch potential XSS vulnerability

Ensures that a URI of the form:

    http://example.com//zend.com

resolves properly to:

    http://example.com/zend.com

and NOT to:

    //zend.com

(The latter of which could present an XSS vector.)

Author: weierophinney

src/Uri.php

@@ -511,11 +511,24 @@ private function filterScheme($scheme)
      */
     private function filterPath($path)
     {
-        return preg_replace_callback(
+        $path = preg_replace_callback(
             '/(?:[^' . self::CHAR_UNRESERVED . ':@&=\+\$,\/;%]+|%(?![A-Fa-f0-9]{2}))/',
             [$this, 'urlEncodeChar'],
             $path
         );
+
+        if (empty($path)) {
+            // No path
+            return $path;
+        }
+
+        if ($path[0] !== '/') {
+            // Relative path
+            return $path;
+        }
+
+        // Ensure only one leading slash, to prevent XSS attempts.
+        return '/' . ltrim($path, '/');
     }
 
     /**

test/UriTest.php

@@ -448,4 +448,11 @@ public function testFragmentIsNotDoubleEncoded()
         $uri = (new Uri())->withFragment($expected);
         $this->assertEquals($expected, $uri->getFragment());
     }
+
+    public function testProperlyTrimsLeadingSlashesToPreventXSS()
+    {
+        $url = 'http://example.org//zend.com';
+        $uri = new Uri($url);
+        $this->assertEquals('http://example.org/zend.com', (string) $uri);
+    }
 }