#51050 [NEW]: FILTER_VALIDATE_URL accepts invalid URLs

From: Date: Mon, 15 Feb 2010 05:21:38 +0000
Subject: #51050 [NEW]: FILTER_VALIDATE_URL accepts invalid URLs
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-147631@lists.php.net to get a copy of this message 
From:             pecoes at gmail dot com
Operating system: WinXP
PHP version:      5.3.1
PHP Bug Type:     Filter related
Bug description:  FILTER_VALIDATE_URL accepts invalid URLs

Description:
------------
Look at the code and its result. How is that validation?

Reproduce code:
---------------
$url = 'http://example.org/"><script>alert(\'oops\');</script';
echo '<a href="', filter_var($url, FILTER_VALIDATE_URL),
'">test</a>';

Expected result:
----------------
<a href="">test</a>

Actual result:
--------------
<a href="http://example.org/"><script>alert('oops');</script">test</a>

-- 
Edit bug report at http://bugs.php.net/?id=51050&edit=1
-- 
Try a snapshot (PHP 5.2):            http://bugs.php.net/fix.php?id=51050&r=trysnapshot52
Try a snapshot (PHP 5.3):            http://bugs.php.net/fix.php?id=51050&r=trysnapshot53
Try a snapshot (PHP 6.0):            http://bugs.php.net/fix.php?id=51050&r=trysnapshot60
Fixed in SVN:                        http://bugs.php.net/fix.php?id=51050&r=fixed
Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=51050&r=needdocs
Fixed in release:                    http://bugs.php.net/fix.php?id=51050&r=alreadyfixed
Need backtrace:                      http://bugs.php.net/fix.php?id=51050&r=needtrace
Need Reproduce Script:               http://bugs.php.net/fix.php?id=51050&r=needscript
Try newer version:                   http://bugs.php.net/fix.php?id=51050&r=oldversion
Not developer issue:                 http://bugs.php.net/fix.php?id=51050&r=support
Expected behavior:                   http://bugs.php.net/fix.php?id=51050&r=notwrong
Not enough info:                     http://bugs.php.net/fix.php?id=51050&r=notenoughinfo
Submitted twice:                     http://bugs.php.net/fix.php?id=51050&r=submittedtwice
register_globals:                    http://bugs.php.net/fix.php?id=51050&r=globals
PHP 4 support discontinued:          http://bugs.php.net/fix.php?id=51050&r=php4
Daylight Savings:                    http://bugs.php.net/fix.php?id=51050&r=dst
IIS Stability:                       http://bugs.php.net/fix.php?id=51050&r=isapi
Install GNU Sed:                     http://bugs.php.net/fix.php?id=51050&r=gnused
Floating point limitations:          http://bugs.php.net/fix.php?id=51050&r=float
No Zend Extensions:                  http://bugs.php.net/fix.php?id=51050&r=nozend
MySQL Configuration Error:           http://bugs.php.net/fix.php?id=51050&r=mysqlcfg

Thread (11 messages)

« previous php.bugs (#147631) next »