sanitizing urls to be encoded before passing them to curl

app/Http/Controllers/ProxyController.php

@@ -156,7 +156,7 @@ class ProxyController extends Controller
 
             $mission = [
                 "resulthash" => $hash,
-                "url" => $targetUrl,
+                "url" => $this->sanitizeUrl($targetUrl),
                 "useragent" => $useragent,
                 "cacheDuration" => $this::PROXY_CACHE,
             ];
@@ -186,7 +186,9 @@ class ProxyController extends Controller
         }
 
         if ($answer === null) {
-            abort(400, "Couldn't fetch response");
+            abort(400, "Couldn't fetch response", [
+                "url" => $targetUrl
+            ]);
         } else {
             $httpcode = $answer["http-code"];
             extract(parse_url($targetUrl));
@@ -298,6 +300,7 @@ class ProxyController extends Controller
         if ($body === false) {
             $body = "";
         }
+        $answer["headers"]["mgproxy-targeturl"] = $targetUrl;
         return response($body, $httpcode)
             ->withHeaders($answer["headers"]);
     }
@@ -499,4 +502,34 @@ class ProxyController extends Controller
             file_put_contents($logFile, $logString, FILE_APPEND);
         }
     }
+
+    private function sanitizeUrl($url){
+        $parts = parse_url($url);
+
+        // Optional but we only sanitize URLs with scheme and host defined
+        if($parts === false || empty($parts["scheme"]) || empty($parts["host"])){
+            return $url;
+        }
+
+        $sanitizedPath = null;
+        if(!empty($parts["path"])){
+            $pathParts = explode("/", $parts["path"]);
+            foreach($pathParts as $pathPart){
+                if(empty($pathPart)) continue;
+                // The Path part might already be urlencoded
+                $sanitizedPath .= "/" . rawurlencode(rawurldecode($pathPart));
+            }
+        }
+
+        // Build the url
+        $targetUrl = $parts["scheme"] . "://" .
+            ((!empty($parts["user"]) && !empty($parts["pass"])) ? $parts["user"] . ":" . $parts["pass"] . "@" : "") .
+            $parts["host"] .
+            (!empty($parts["port"]) ? ":" . $parts["port"] : "") .
+            (!empty($sanitizedPath) ? $sanitizedPath : "") .
+            (!empty($parts["query"]) ? "?" . $parts["query"] : "") .
+            (!empty($parts["fragment"]) ? "#" . $parts["fragment"] : "");
+
+        return $targetUrl;
+    }
 }