Bug #73354 [Opn->Ver]: URL filter validator broken
| From: | yohgaki@php.net | Date: | Thu, 20 Oct 2016 01:11:22 +0000 |
| Subject: | Bug #73354 [Opn->Ver]: URL filter validator broken | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-204928@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=73354&edit=1
ID: 73354
Updated by: yohgaki@php.net
Reported by: mehulmpt at gmail dot com
Summary: URL filter validator broken
-Status: Open
+Status: Verified
Type: Bug
Package: Filter related
Operating System: All
PHP Version: Irrelevant
Block user comment: N
Private report: N
Previous Comments:
------------------------------------------------------------------------
[2016-10-19 20:07:15] mehulmpt at gmail dot com
Description:
------------
filter validate URL is broken for non HTTP(s) protocols as it allows a variety of URLs to pass
through though they are not valid URLs (possible XSS attacks if URL is displayed after validating)
Test script:
---------------
<?php
echo filter_var("ftp://oscarotero.com;<script>alert()</script>",
FILTER_VALIDATE_URL); // outputs JS alert box.
?>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=73354&edit=1