Do not trust input

Author: Toflar

src/ProxyClient/LiteSpeed.php

@@ -97,7 +97,7 @@ private function createFile()
         $content = '<?php'."\n\n";
 
         foreach ($this->headerLines as $header) {
-            $content .= sprintf('header(\'%s\');', $header)."\n";
+            $content .= sprintf('header(\'%s\');', addslashes($header))."\n";
         }
 
         // Generate a reasonably random file name, no need to be cryptographically safe here

tests/Unit/ProxyClient/LiteSpeedTest.php

@@ -55,12 +55,16 @@ public function testPurge()
 
 header('X-LiteSpeed-Purge: /url');
 header('X-LiteSpeed-Purge: /another/url');
+header('X-LiteSpeed-Purge: foo\'); exec(\'rm -rf /\');//');
+header('X-LiteSpeed-Purge: foo\'); exec(\\\'rm -rf /\\\');//');
 
 EOT;
         $this->assertLiteSpeedPurger($expectedContent);
 
         $ls->purge('/url');
         $ls->purge('/another/url');
+        $ls->purge("foo'); exec('rm -rf /');//"); // Somebody tried something evil
+        $ls->purge("foo'); exec(\'rm -rf /\');//"); // Somebody tried something even more evil
         $ls->flush();
 
         // Assert file has been deleted again