Nov 5, 2024 · Oct 25, 2024 · Nov 6, 2024 · Nov 6, 2024 · Nov 6, 2024 · Nov 6, 2024
diff --git a/src/Symfony/Component/DependencyInjection/EnvVarProcessor.php b/src/Symfony/Component/DependencyInjection/EnvVarProcessor.php
            if (!isset($params['scheme'], $params['host'])) {
                throw new RuntimeException(\sprintf('Invalid URL in env var "%s": scheme and host expected.', $name));
            }
            if (('\\' !== \DIRECTORY_SEPARATOR || 'file' !== $params['scheme']) && false !== ($i = strpos($env, '\\')) && $i < strcspn($env, '?#')) {
                throw new RuntimeException(\sprintf('Invalid URL in env var "%s": backslashes are not allowed.', $name));
            }
            if (\ord($env[0]) <= 32 || \ord($env[-1]) <= 32 || \strlen($env) !== strcspn($env, "\r\n\t")) {
                throw new RuntimeException(\sprintf('Invalid URL in env var "%s": leading/trailing ASCII control characters or whitespaces are not allowed.', $name));
            }
            $params += [
                'port' => null,
                'user' => null,
diff --git a/src/Symfony/Component/DependencyInjection/Tests/EnvVarProcessorTest.php b/src/Symfony/Component/DependencyInjection/Tests/EnvVarProcessorTest.php
        ];
    }

    /**
     * @testWith ["http://foo.com\\bar"]
     *           ["\\\\foo.com/bar"]
     *           ["a\rb"]
     *           ["a\nb"]
     *           ["a\tb"]
     *           ["\u0000foo"]
     *           ["foo\u0000"]
     *           [" foo"]
     *           ["foo "]
     *           [":"]
     */
    public function testGetEnvBadUrl(string $url)
    {
        $this->expectException(RuntimeException::class);

        (new EnvVarProcessor(new Container()))->getEnv('url', 'foo', static function () use ($url): string {
            return $url;
        });
    }

    /**
     * @testWith    ["", "string"]
     *              [null, ""]
diff --git a/src/Symfony/Component/HttpClient/HttpClientTrait.php b/src/Symfony/Component/HttpClient/HttpClientTrait.php
     */
    private static function parseUrl(string $url, array $query = [], array $allowedSchemes = ['http' => 80, 'https' => 443]): array
    {
        if (false !== ($i = strpos($url, '\\')) && $i < strcspn($url, '?#')) {
            throw new InvalidArgumentException(\sprintf('Malformed URL "%s": backslashes are not allowed.', $url));
        }
        if (\strlen($url) !== strcspn($url, "\r\n\t")) {
            throw new InvalidArgumentException(\sprintf('Malformed URL "%s": CR/LF/TAB characters are not allowed.', $url));
        }
        if ('' !== $url && (\ord($url[0]) <= 32 || \ord($url[-1]) <= 32)) {
            throw new InvalidArgumentException(\sprintf('Malformed URL "%s": leading/trailing ASCII control characters or spaces are not allowed.', $url));
        }

        if (false === $parts = parse_url($url)) {
            if ('/' !== ($url[0] ?? '') || false === $parts = parse_url($url.'#')) {
                throw new InvalidArgumentException(\sprintf('Malformed URL "%s".', $url));
diff --git a/src/Symfony/Component/HttpClient/Tests/HttpClientTraitTest.php b/src/Symfony/Component/HttpClient/Tests/HttpClientTraitTest.php
        self::resolveUrl(self::parseUrl('localhost:8080'), null);
    }

    public functiontestResolveBaseUrlWitoutScheme()
    public functiontestResolveBaseUrlWithoutScheme()
    {
        $this->expectException(InvalidArgumentException::class);
        $this->expectExceptionMessage('Invalid URL: scheme is missing in "//localhost:8081". Did you forget to add "http(s)://"?');
        self::resolveUrl(self::parseUrl('/foo'), self::parseUrl('localhost:8081'));
    }

    /**
     * @testWith ["http://foo.com\\bar"]
     *           ["\\\\foo.com/bar"]
     *           ["a\rb"]
     *           ["a\nb"]
     *           ["a\tb"]
     *           ["\u0000foo"]
     *           ["foo\u0000"]
     *           [" foo"]
     *           ["foo "]
     *           [":"]
     */
    public function testParseMalformedUrl(string $url)
    {
        $this->expectException(InvalidArgumentException::class);
        $this->expectExceptionMessage('Malformed URL');
        self::parseUrl($url);
    }

    /**
     * @dataProvider provideParseUrl
     */
diff --git a/src/Symfony/Component/Routing/RequestContext.php b/src/Symfony/Component/Routing/RequestContext.php

    public static function fromUri(string $uri, string $host = 'localhost', string $scheme = 'http', int $httpPort = 80, int $httpsPort = 443): self
    {
        if (false !== ($i = strpos($uri, '\\')) && $i < strcspn($uri, '?#')) {
            $uri = '';
        }
        if ('' !== $uri && (\ord($uri[0]) <= 32 || \ord($uri[-1]) <= 32 || \strlen($uri) !== strcspn($uri, "\r\n\t"))) {
            $uri = '';
        }

        $uri = parse_url($uri);
        $scheme = $uri['scheme'] ?? $scheme;
        $host = $uri['host'] ?? $host;
diff --git a/src/Symfony/Component/Routing/Tests/RequestContextTest.php b/src/Symfony/Component/Routing/Tests/RequestContextTest.php
        $this->assertSame('/', $requestContext->getPathInfo());
    }

    /**
     * @testWith ["http://foo.com\\bar"]
     *           ["\\\\foo.com/bar"]
     *           ["a\rb"]
     *           ["a\nb"]
     *           ["a\tb"]
     *           ["\u0000foo"]
     *           ["foo\u0000"]
     *           [" foo"]
     *           ["foo "]
     *           [":"]
     */
    public function testFromBadUri(string $uri)
    {
        $context = RequestContext::fromUri($uri);

        $this->assertSame('http', $context->getScheme());
        $this->assertSame('localhost', $context->getHost());
        $this->assertSame('', $context->getBaseUrl());
        $this->assertSame('/', $context->getPathInfo());
    }

    public function testFromRequest()
    {
        $request = Request::create('https://test.com:444/foo?bar=baz');
Original file line number	Diff line number	Diff line change
Expand Up		@@ -310,6 +310,12 @@
		if (!isset($params['scheme'], $params['host'])) {
		throw new RuntimeException(\sprintf('Invalid URL in env var "%s": scheme and host expected.', $name));
		}
		if (('\\' !== \DIRECTORY_SEPARATOR \|\| 'file' !== $params['scheme']) && false !== ($i = strpos($env, '\\')) && $i < strcspn($env, '?#')) {
		throw new RuntimeException(\sprintf('Invalid URL in env var "%s": backslashes are not allowed.', $name));
		}
		if (\ord($env[0]) <= 32 \|\| \ord($env[-1]) <= 32 \|\| \strlen($env) !== strcspn($env, "\r\n\t")) {
Check failure on line 316 in src/Symfony/Component/DependencyInjection/EnvVarProcessor.php View workflow job for this annotation GitHub Actions/ Psalm InvalidArrayAccess `src/Symfony/Component/DependencyInjection/EnvVarProcessor.php:316:22: InvalidArrayAccess: Cannot access array value on non-array variable $env of type scalar (see https://psalm.dev/005)` Check failure on line 316 in src/Symfony/Component/DependencyInjection/EnvVarProcessor.php View workflow job for this annotation GitHub Actions/ Psalm InvalidArrayAccess `src/Symfony/Component/DependencyInjection/EnvVarProcessor.php:316:45: InvalidArrayAccess: Cannot access array value on non-array variable $env of type scalar (see https://psalm.dev/005)` Check failure on line 316 in src/Symfony/Component/DependencyInjection/EnvVarProcessor.php View workflow job for this annotation GitHub Actions/ Psalm InvalidArrayAccess `src/Symfony/Component/DependencyInjection/EnvVarProcessor.php:316:22: InvalidArrayAccess: Cannot access array value on non-array variable $env of type scalar (see https://psalm.dev/005)` Check failure on line 316 in src/Symfony/Component/DependencyInjection/EnvVarProcessor.php View workflow job for this annotation GitHub Actions/ Psalm InvalidArrayAccess `src/Symfony/Component/DependencyInjection/EnvVarProcessor.php:316:45: InvalidArrayAccess: Cannot access array value on non-array variable $env of type scalar (see https://psalm.dev/005)`
		throw new RuntimeException(\sprintf('Invalid URL in env var "%s": leading/trailing ASCII control characters or whitespaces are not allowed.', $name));
		}
		$params += [
		'port' => null,
		'user' => null,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -996,6 +996,27 @@ public static function provideGetEnvUrlPath()
		];
		}

		/**
		* @testWith ["http://foo.com\\bar"]
		* ["\\\\foo.com/bar"]
		* ["a\rb"]
		* ["a\nb"]
		* ["a\tb"]
		* ["\u0000foo"]
		* ["foo\u0000"]
		* [" foo"]
		* ["foo "]
		* [":"]
		*/
		public function testGetEnvBadUrl(string $url)
		{
		$this->expectException(RuntimeException::class);

		(new EnvVarProcessor(new Container()))->getEnv('url', 'foo', static function () use ($url): string {
		return $url;
		});
		}

		/**
		* @testWith ["", "string"]
		* [null, ""]
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -625,6 +625,16 @@ private static function resolveUrl(array $url, ?array $base, array $queryDefault
		*/
		private static function parseUrl(string $url, array $query = [], array $allowedSchemes = ['http' => 80, 'https' => 443]): array
		{
		if (false !== ($i = strpos($url, '\\')) && $i < strcspn($url, '?#')) {
		throw new InvalidArgumentException(\sprintf('Malformed URL "%s": backslashes are not allowed.', $url));
		}
		if (\strlen($url) !== strcspn($url, "\r\n\t")) {
		throw new InvalidArgumentException(\sprintf('Malformed URL "%s": CR/LF/TAB characters are not allowed.', $url));
		}
		if ('' !== $url && (\ord($url[0]) <= 32 \|\| \ord($url[-1]) <= 32)) {
		throw new InvalidArgumentException(\sprintf('Malformed URL "%s": leading/trailing ASCII control characters or spaces are not allowed.', $url));
		}

		if (false === $parts = parse_url($url)) {
		if ('/' !== ($url[0] ?? '') \|\| false === $parts = parse_url($url.'#')) {
		throw new InvalidArgumentException(\sprintf('Malformed URL "%s".', $url));
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -239,13 +239,32 @@ public function testResolveUrlWithoutScheme()
		self::resolveUrl(self::parseUrl('localhost:8080'), null);
		}

		public functiontestResolveBaseUrlWitoutScheme()
		public functiontestResolveBaseUrlWithoutScheme()
		{
		$this->expectException(InvalidArgumentException::class);
		$this->expectExceptionMessage('Invalid URL: scheme is missing in "//localhost:8081". Did you forget to add "http(s)://"?');
		self::resolveUrl(self::parseUrl('/foo'), self::parseUrl('localhost:8081'));
		}

		/**
		* @testWith ["http://foo.com\\bar"]
		* ["\\\\foo.com/bar"]
		* ["a\rb"]
		* ["a\nb"]
		* ["a\tb"]
		* ["\u0000foo"]
		* ["foo\u0000"]
		* [" foo"]
		* ["foo "]
		* [":"]
		*/
		public function testParseMalformedUrl(string $url)
		{
		$this->expectException(InvalidArgumentException::class);
		$this->expectExceptionMessage('Malformed URL');
		self::parseUrl($url);
		}

		/**
		* @dataProvider provideParseUrl
		*/
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -47,6 +47,13 @@ public function __construct(string $baseUrl = '', string $method = 'GET', string

		public static function fromUri(string $uri, string $host = 'localhost', string $scheme = 'http', int $httpPort = 80, int $httpsPort = 443): self
		{
		if (false !== ($i = strpos($uri, '\\')) && $i < strcspn($uri, '?#')) {
		$uri = '';
		}
		if ('' !== $uri && (\ord($uri[0]) <= 32 \|\| \ord($uri[-1]) <= 32 \|\| \strlen($uri) !== strcspn($uri, "\r\n\t"))) {
		$uri = '';
		}

		$uri = parse_url($uri);
		$scheme = $uri['scheme'] ?? $scheme;
		$host = $uri['host'] ?? $host;
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -85,6 +85,28 @@ public function testFromUriBeingEmpty()
		$this->assertSame('/', $requestContext->getPathInfo());
		}

		/**
		* @testWith ["http://foo.com\\bar"]
		* ["\\\\foo.com/bar"]
		* ["a\rb"]
		* ["a\nb"]
		* ["a\tb"]
		* ["\u0000foo"]
		* ["foo\u0000"]
		* [" foo"]
		* ["foo "]
		* [":"]
		*/
		public function testFromBadUri(string $uri)
		{
		$context = RequestContext::fromUri($uri);

		$this->assertSame('http', $context->getScheme());
		$this->assertSame('localhost', $context->getHost());
		$this->assertSame('', $context->getBaseUrl());
		$this->assertSame('/', $context->getPathInfo());
		}

		public function testFromRequest()
		{
		$request = Request::create('https://test.com:444/foo?bar=baz');
Expand Down