NotificationsYou must be signed in to change notification settings
Fork9.6k
Star30.4k

[DependencyInjection][HttpClient][Routing] Reject URIs that contain invalid characters#58776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

nicolas-grekas merged 1 commit intosymfony:7.2fromnicolas-grekas:parse-url-hardening

Nov 6, 2024

Merged

[DependencyInjection][HttpClient][Routing] Reject URIs that contain invalid characters#58776

nicolas-grekas merged 1 commit intosymfony:7.2fromnicolas-grekas:parse-url-hardening

Nov 6, 2024

Conversation

Copy link

Member

nicolas-grekas commentedNov 6, 2024

Q	A
Branch?	7.2
Bug fix?	no
New feature?	no
Deprecations?	no
Issues	-
License	MIT

The behavior ofparse_url() doesn't match how browsers parse URLs. This PR ensures we won't accept URLs that are invalid perhttps://url.spec.whatwg.org/:

URLs that contain a backslash
or start/end with a control-char or a space
or contain a CR/LF/TAB character

[DependencyInjection][Routing][HttpClient] Reject URIs that contain i…

d73003e

…nvalid characters

carsonbot added Status: Needs Review DependencyInjection HttpClient Routing labels

Nov 6, 2024

carsonbot added this to the7.2 milestone

Nov 6, 2024

carsonbot changed the title~~[DependencyInjection][Routing][HttpClient] Reject URIs that contain invalid characters~~[DependencyInjection][HttpClient][Routing] Reject URIs that contain invalid characters

Nov 6, 2024