fix: resolve and the 404 report refuse NUL and invalid UTF-8 addresses (WR-12)

A decoded path such as /%00 or /%FF reached Postgres as text and answered
500 with an error log line per request. parseTarget refuses a path or
query that is not valid UTF-8 or holds NUL (422), NotFoundPath does the
same for the logged address, and a referer is cleaned of both.

classes/resolver.go

@@ -6,6 +6,7 @@ import (
 	"net/url"
 	"sort"
 	"strings"
+	"unicode/utf8"
 
 	"git.golem15.com/golem15/sm-seo-plugin/models"
 	"git.golem15.com/golem15/summercms/modules/cabana"
@@ -215,7 +216,28 @@ func parseTarget(raw string) (string, url.Values, error) {
 	if path == "" {
 		path = "/"
 	}
-	return path, u.Query(), nil
+	query := u.Query()
+	if !safeText(path) || !safeText(u.RawQuery) {
+		return "", nil, ErrBadURL
+	}
+	for k, vs := range query {
+		if !safeText(k) {
+			return "", nil, ErrBadURL
+		}
+		for _, v := range vs {
+			if !safeText(v) {
+				return "", nil, ErrBadURL
+			}
+		}
+	}
+	return path, query, nil
+}
+
+// safeText reports whether s can be stored and compared as Postgres text:
+// valid UTF-8 without NUL bytes. A decoded path such as /%00 or /%FF is
+// not (WR-12).
+func safeText(s string) bool {
+	return utf8.ValidString(s) && !strings.ContainsRune(s, 0)
 }
 
 // contentLocale returns the record's description in locale, else its first