Page MenuHomePhabricator
Differential D17647

Reject ambiguous URIs with unescaped "#" or "?" in username/password parts
ClosedPublic
Actions

Authored by epriestley on Apr 10 2017, 4:54 PM.

Details

Reviewers
chad
Maniphest Tasks
T12526: parse_url() behavior has changed with PHP7, causing libphutil unit tests to fail and possibly creating security concerns
Commits
rPHUfb9e0642c4ea: Reject ambiguous URIs with unescaped "#" or "?" in username/password parts
Summary

Fixes T12526. These URIs are ambiguous and nonstandard, and different versions of different clients parse them differently.

Instead of trying to get this right across PHP versions, just reject these outright. No normal user will ever expect these to work.

Test Plan

Ran unit tests in PHP 7.1, got clean results. See T12526 for more discussion.

Diff Detail

Repository
rPHU libphutil
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Revision Contents
Changeset List

PathSize
src/
parser/
10 lines
__tests__/
43 lines

Diff 42442

View Options

src/parser/PhutilURI.php

Loading...
View Options

src/parser/__tests__/PhutilURITestCase.php

Loading...
Phabricator · Built by Phacility