Bug #69670 [Opn->Nab]: bad url filtering with filer_flag_host_required

Edit report at https://bugs.php.net/bug.php?id=69670&edit=1 ID: 69670 Updated by: cmb@php.net Reported by: alexglue at gmail dot com Summary: bad url filtering with filer_flag_host_required -Status: Open +Status: Not a bug Type: Bug -Package: *General Issues +Package: Variables related Operating System: ubuntu 14.04 PHP Version: 5.6Git-2015-05-20 (Git) -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: The sanitize filters are not meant to do validation. Especially, FILTER_SANITIZE_URL doesn't accept the FILTER_FLAG_*_REQUIRED flags. Compare that to FILTER_VALIDATE_URL[1]. (FILTER_FLAG_SCHEME_REQUIRED and FILTER_FLAG_HOST_REQUIRED are not listed there, but that has already been reported as bug #66938.) See also <http://3v4l.org/jTcfW>. [1] <http://php.net/manual/en/filter.filters.validate.php> Previous Comments: ------------------------------------------------------------------------ [2015-05-20 09:48:16] alexglue at gmail dot com Description: ------------ --- From manual page: http://www.php.net/function.filter-var --- With test script usage we'll got this: result: http:///path/by/path?query=124 /path/by/path?query=124 instead of false value; my php version is "PHP 5.5.9-1ubuntu4.7 (cli) (built: Mar 16 2015 20:47:39)" Test script: --------------- <?php $uri = 'http:///path/by/path?query=124'; $uri = filter_var($uri, FILTER_SANITIZE_URL, FILTER_FLAG_HOST_REQUIRED); var_dump($uri); $uri = '/path/by/path?query=124'; $uri = filter_var($uri, FILTER_SANITIZE_URL, FILTER_FLAG_HOST_REQUIRED); var_dump($uri); ?> Expected result: ---------------- Expected false value when no hostname provided and FILTER_FLAG_HOST_REQUIRED option set; ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69670&edit=1