Version 5.0.0 beta 5

system/Text/HtmlPurifierInternalLinkDef.php

@@ -17,6 +17,7 @@ use HTMLPurifier_Config;
 use HTMLPurifier_Context;
 use IPS\File;
 use IPS\Http\Url;
+use IPS\Http\Url\Exception as UrlException;
 use IPS\Http\Url\Friendly;
 use IPS\Http\Url\Internal;
 use IPS\Settings;
@@ -61,8 +62,15 @@ class HtmlPurifierInternalLinkDef extends HTMLPurifier_AttrDef_URI
     public function validate($uri, $config, $context): bool|string
 	{
 	    /* Create the URL */
-	    $url = Url::createFromString( str_replace( array( '%7B___base_url___%7D/', '{___base_url___}/' ), Settings::i()->base_url, $uri ) );
-	    
+		try
+		{
+			$url = Url::createFromString( str_replace( array( '%7B___base_url___%7D/', '{___base_url___}/' ), Settings::i()->base_url, $uri ) );
+		}
+		catch( UrlException $e )
+		{
+			return FALSE;
+		}
+
 	    /* If it's not internal, we can stop now */
 	    if ( !( $url instanceof Internal ) )
 	    {