From 126a49185229f248eae8c485b3e16e029ebcb353 Mon Sep 17 00:00:00 2001
From: polo <ordipolo@gmx.fr>
Date: Fri, 23 Oct 2026 23:29:59 +0200
Subject: =?UTF-8?q?audit=20claude=20code=201,=20validation=20formulaire=20?=
 =?UTF-8?q?toujours=20ok,=20=C3=A9chappement=20dans=20URL,=20quelques=20ht?=
 =?UTF-8?q?mlspecialchars=20manquants,=20fonction=20Security::validateURL?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Service/URL.php | 27 +++++++--------------------
 1 file changed, 7 insertions(+), 20 deletions(-)

(limited to 'src/Service/URL.php')

diff --git a/src/Service/URL.php b/src/Service/URL.php
index 035f572..e6f986c 100644
--- a/src/Service/URL.php
+++ b/src/Service/URL.php
@@ -58,33 +58,20 @@ class URL implements \Stringable
 	public function setAnchor(string $anchor = ''): void
 	{
 		if($anchor != ''){
-			$this->anchor = '#' . ltrim($anchor, '#');
+			$this->anchor = '#' . rawurlencode(ltrim($anchor, '#'));// rawurlencode échappe les mêmes caractères
 		}
 		else{
 			$this->anchor = '';
 		}
 	}
 
-	private function makeParams(): string
-	{
-		$output = '';
-		$first = true;
-		
-		foreach($this->params as $key => $value) {
-			if($first){
-				$output .= '?';
-				$first = false;
-			}
-			else{
-				$output .= '&';
-			}
-			$output .= $key . '=' . $value;
-		}
-		return $output;
-	}
-
 	public function __toString(): string
 	{
-		return self::$protocol . self::$host . self::$port . self::$path . $this->makeParams() . $this->anchor;
+		return self::$protocol . self::$host . self::$port . self::$path
+			. ($this->params ? '?' . http_build_query($this->params) : '')
+			. $this->anchor;
+		// http_build_query change un tableau comme ['key1' => 'value 1', 'key2' => 'value 2']
+		// en chaine: key1=value+1&key2=value+2
+		// les caractères ", ', <, >, &, #, = et espaces sont échappés (comme avec rawurlencode pour les ancres)
 	}
 }
\ No newline at end of file
-- 
cgit v1.2.3