Bug #74875 [Csd->Dup]: FILTER_VALIDATE_URL has bug with "/" in query string

Edit report at https://bugs.php.net/bug.php?id=74875&edit=1 ID: 74875 Updated by: requinix@php.net Reported by: benedikt at piwnica dot de Summary: FILTER_VALIDATE_URL has bug with "/" in query string -Status: Closed +Status: Duplicate Type: Bug Package: Filter related PHP Version: 7.0.21 Block user comment: N Private report: N New Comment: The URL filter actually parses the string, which puts this in bug #73192 territory. Previous Comments: ------------------------------------------------------------------------ [2017-07-07 12:51:35] benedikt at piwnica dot de Is fixed since 7.0.13! Thanks for the comment. ------------------------------------------------------------------------ [2017-07-07 12:36:26] mail at pmmaga dot net The issue seems to be fixed since 7.0.13: https://3v4l.org/Tmg17 ------------------------------------------------------------------------ [2017-07-07 12:32:11] benedikt at piwnica dot de Description: ------------ Hey there, I wrote a validation script using filter_var($url, FILTER_VALIDATE_URL) and some tests for the script. Now I've discovered a mistake while validating an url with a slash in the query string. Is there a pathname like in https://test.com/?q=123/456 or https://test.com/x/y/z?q=123/456 the url is valid. Is there no pathname like in https://test.com?q=123/456 the url is not valid. Could it be, that there is a bug in the regex? Test script: --------------- <?php var_dump(filter_var("https://test.com/?q=123456", FILTER_VALIDATE_URL)); var_dump(filter_var("https://test.com?q=123456", FILTER_VALIDATE_URL)); var_dump(filter_var("https://test.com/?q=123/456", FILTER_VALIDATE_URL)); var_dump(filter_var("https://test.com?q=123/456", FILTER_VALIDATE_URL)); Expected result: ---------------- string 'https://test.com/?q=123456' (length=26) string 'https://test.com?q=123456' (length=25) string 'https://test.com/?q=123/456' (length=27) string 'https://test.com?q=123/456' (length=26) Actual result: -------------- string 'https://test.com/?q=123456' (length=26) string 'https://test.com?q=123456' (length=25) string 'https://test.com/?q=123/456' (length=27) boolean false ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74875&edit=1