NotificationsYou must be signed in to change notification settings
Fork9.7k
Star30.7k

[Validator] Update regular expression in URL validator#62028

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

nicolas-grekas merged 1 commit intosymfony:6.4frommjaschen:feature/url-validator-userinfo

Oct 16, 2025

Merged

[Validator] Update regular expression in URL validator#62028

nicolas-grekas merged 1 commit intosymfony:6.4frommjaschen:feature/url-validator-userinfo

Oct 16, 2025

+17 −13

Conversation

Copy link

Contributor

mjaschen commentedOct 10, 2025•
edited by nicolas-grekas
Loading

Q	A
Branch?	6.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Issues	-
License	MIT

TheUrlValidator::validate() method currently fails for some valid URLs, particularly URLs containing login data with special characters.

Example failing case:

https://user-123:foo+bar-baz@example.com/path/file.txt.gz

The current regular expression only accepts a subset of allowed characters in the userinfo part of the URL, seeUrlValidator.php:26.

Changes in this pull request:

Update the regular expression inUrlValidator::PATTERN to support all characters permitted in theuserinfo part of a URL according toRFC 3986.
remove unneeded escaping in regular expression character class ([\_\.] →[_.])
Add new test cases covering all special characters in theuserinfo part of URLs.

References:

RFC 3986 describing: Uniform Resource Identifier (URI) Generic Syntax
Appendix A, “Collected ABNF for URI”

Relevant ABNF foruserinfo in URIs:

userinfo      = *( unreserved / pct-encoded / sub-delims / ":" )unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"pct-encoded   = "%" HEXDIG HEXDIGsub-delims    = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="

carsonbot added Status: Needs Review Feature labels

Oct 10, 2025

carsonbot added this to the7.4 milestone

Oct 10, 2025

Copy link

carsonbot commentedOct 10, 2025

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

Always add tests
Keep backward compatibility (seehttps://symfony.com/bc).
Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
Features and deprecations must be submitted against the 7.4 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

carsonbot changed the title~~Update regular expression in URL validator~~ Update regular expression in URL validator

Oct 10, 2025

nicolas-grekas added the Validator label

Oct 14, 2025

carsonbot changed the title ~~Update regular expression in URL validator~~[Validator] Update regular expression in URL validator

Oct 14, 2025

nicolas-grekas modified the milestones:7.4,6.4

Oct 14, 2025

nicolas-grekas added Bug and removed Feature labels

Oct 14, 2025

Update regular expression in URL validator

82bbb9c

To achieve better compatibility with RFC 3986, the regular expressionwhich validates URLs now allows more characters in the userinfo part.Add test cases; update change log.

nicolas-grekas changed the base branch from7.4 to6.4

October 14, 2025 16:28

nicolas-grekas requested review fromchalasr,dunglas,lyrixx,xabbuh andyceruto ascode owners

October 14, 2025 16:28

nicolas-grekas force-pushed thefeature/url-validator-userinfo branch fromd385f3e to82bbb9cCompare

October 14, 2025 16:28

nicolas-grekas approved these changes

Oct 14, 2025

View reviewed changes

Copy link

Member

nicolas-grekas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I rebased for 6.4 as a bugfix and further tweaked the regex a bit.

carsonbot added Status: Reviewed and removed Status: Needs Review labels

Oct 14, 2025

nicolas-grekas reviewed

Oct 14, 2025

View reviewed changes

src/Symfony/Component/Validator/Constraints/UrlValidator.php

		{^
		(%s):// # protocol
		(((?:[\_\.\pL\pN-]\|%%[0-9A-Fa-f]{2})+:)?((?:[\_\.\pL\pN-]\|%%[0-9A-Fa-f]{2})+)@)? # basic auth
		((?:[\pL\pN\-._~!$&'()+,;=]\|%%[0-9A-Fa-f]{2})++(?::(?:[:\pL\pN\-._~!$&'()+,;=]\|%%[0-9A-Fa-f]{2})*+)?@)? # basic auth

Copy link

Member

nicolas-grekasOct 14, 2025•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The RFC allows empty user part, so technically we could go with just the following.
But this makes tests fail as we consider userinfo with no username as invalid (http://:pwd@example.com)

Suggested change

	((?:[\pL\pN\-._~!$&'()+,;=]\|%%[0-9A-Fa-f]{2})++(?::(?:[:\pL\pN\-._~!$&'()+,;=]\|%%[0-9A-Fa-f]{2})*+)?@)?# basic auth
	((?:[:\pL\pN\-._~!$&'()*+,;=]\|%%[0-9A-Fa-f]{2})++)@)? # basic auth