Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.6k
[DependencyInjection][HttpClient][Routing] Reject vertical tab in URIs#59511
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
src/Symfony/Component/DependencyInjection/Tests/EnvVarProcessorTest.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
32e04f7
toa35e6ae
Comparea35e6ae
toe5c0383
CompareWhy exclude vertical tabs? |
Like horizontal tabs and other control characters, this char should not appear in a URL. We already have a check for control chars, this one can be added for completeness? |
Vertical tabs are not mentioned on the URL spec:https://url.spec.whatwg.org/ |
alexandre-daubois commentedJan 17, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
The URL spec mentions that C0 controls are forbidden, and |
I can't see where the vertical tab needs this special handling. Please link to the exact sentences you have in mind? |
alexandre-daubois commentedJan 17, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
I don't think the vertical tab needs a special check, the proposed patch is not a good idea as explained by your comments. Reading the spec again, I'm wondering if we should still ensure the host doesn't contain C0 control chars, as stated inhttps://url.spec.whatwg.org/#forbidden-host-code-point ? There are check that ensure there are no leading/trailing C0 chars in the URL, but it does not check the host if I understand correctly |
I'm not sure. Which problem would that solve? |
The code would closer follow the living standard. Indeed parse_url seems to handle it but the output seems "wrong" as the spec says it should be invalid. |
Let's close yes. We don't need a spec-compliant parser here. There are third party libs for that. |
Follows:
Also,
\v
is not supported in the@testWith
annotation, thus converting them to data providers.