Bug #72301 [Com]: filter_var($url, FILTER_VALIDATE_URL) does not support scheme-relative URLs
Edit report at https://bugs.php.net/bug.php?id=72301&edit=1
ID: 72301
Comment by: ihipop+php at gmail dot com
Reported by: ian+php at ians-net dot co dot uk
Summary: filter_var($url, FILTER_VALIDATE_URL) does not
support scheme-relative URLs
Status: Open
Type: Bug
Package: Filter related
Operating System: OpenBSD
PHP Version: 7.0.7
Block user comment: N
Private report: N
New Comment:
I think a new flag should be add to obey the RFC3986,and compatible with the old behavior
Previous Comments:
------------------------------------------------------------------------
[2016-06-30 15:18:49] apokryfos84 at gmail dot com
The problem is that FILTER_VALIDATE_URL uses RFC 2396 which is older than RFC 3986. This would have
been OK if the language was consistent in the URL RFC it was using, however parse_url seems to be
using RFC3986, making the following code to behave unexpectedly.
if (filter_var($url,FILTER_VALIDATE_URL)) {
$parts = parse_url($url);
}
Note: I am only assuming that parse_url uses RFC 3986 because there's a link to it in the
"see also" links of http://php.net/manual/en/function.parse-url.php
------------------------------------------------------------------------
[2016-05-31 10:07:05] derick@php.net
If this gets added, it should be done with an optional (off by default) new flag.
------------------------------------------------------------------------
[2016-05-31 09:26:53] ian+php at ians-net dot co dot uk
Description:
------------
RFC3986 allows scheme relative URLs, also termed network-path references. These are commonly used to
ensure the appropriate protocol is used to fetch the resource regardless of whether the resource is
embedded in a http or https page.
filter_var($url, FILTER_VALIDATE_URL) does not correctly validate these URLs
See also
https://tools.ietf.org/html/rfc3986#section-4.2
https://url.spec.whatwg.org/#syntax-url-scheme-relative
Test script:
---------------
var_dump(filter_var("//google.com/", FILTER_VALIDATE_URL));
Expected result:
----------------
bool(true)
Actual result:
--------------
bool(false)
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72301&edit=1
Thread (5 messages)