Bug #74875 [NEW]: FILTER_VALIDATE_URL has bug with "/" in query string

From: benedikt at piwnica dot de Operating system: PHP version: 7.0.21 Package: Filter related Bug Type: Bug Bug description:FILTER_VALIDATE_URL has bug with "/" in query string Description: ------------ Hey there, I wrote a validation script using filter_var($url, FILTER_VALIDATE_URL) and some tests for the script. Now I've discovered a mistake while validating an url with a slash in the query string. Is there a pathname like in https://test.com/?q=123/456 or https://test.com/x/y/z?q=123/456 the url is valid. Is there no pathname like in https://test.com?q=123/456 the url is not valid. Could it be, that there is a bug in the regex? Test script: --------------- <?php var_dump(filter_var("https://test.com/?q=123456", FILTER_VALIDATE_URL)); var_dump(filter_var("https://test.com?q=123456", FILTER_VALIDATE_URL)); var_dump(filter_var("https://test.com/?q=123/456", FILTER_VALIDATE_URL)); var_dump(filter_var("https://test.com?q=123/456", FILTER_VALIDATE_URL)); Expected result: ---------------- string 'https://test.com/?q=123456' (length=26) string 'https://test.com?q=123456' (length=25) string 'https://test.com/?q=123/456' (length=27) string 'https://test.com?q=123/456' (length=26) Actual result: -------------- string 'https://test.com/?q=123456' (length=26) string 'https://test.com?q=123456' (length=25) string 'https://test.com/?q=123/456' (length=27) boolean false -- Edit bug report at https://bugs.php.net/bug.php?id=74875&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74875&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74875&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74875&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74875&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74875&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74875&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74875&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74875&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74875&r=support Expected behavior: https://bugs.php.net/fix.php?id=74875&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74875&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74875&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74875&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74875&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74875&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74875&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74875&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74875&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74875&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74875&r=mysqlcfg