Bug #68296 [Com]: \n in path with parse_url() converts to underscore

Edit report at https://bugs.php.net/bug.php?id=68296&edit=1 ID: 68296 Comment by: gonzad26 at gmail dot com Reported by: dave at lyte dot id dot au Summary: \n in path with parse_url() converts to underscore Status: Open Type: Bug Package: URL related Operating System: OS X PHP Version: 5.4.34 Block user comment: N Private report: N New Comment: Pardon me, bug still in PHP 7.1.7. Previous Comments: ------------------------------------------------------------------------ [2018-01-11 19:05:15] spam2 at rhsoft dot net besides PHP5 is EOL what do you expect? garbage in, garbage out! control chars don't belong into a url - it's that simple and if you don't sanitze and validate your input data be happy that someone does what do you think happens with null chars and freinds if you concat your remote URL based on userinput and obviously don't care about handle untrusted data careful? ------------------------------------------------------------------------ [2018-01-11 19:01:02] gonzad26 at gmail dot com The problem still persists in php 5.6. Doing: parse_url($path,PHP_URL_HOST); if $path has a "\n" parse_url returns and _ where the \n was. ------------------------------------------------------------------------ [2016-01-15 08:11:46] simonsimcity at gmail dot com Sorry, I meant related to #52923 ------------------------------------------------------------------------ [2016-01-15 08:11:08] simonsimcity at gmail dot com Is related to #68296 ------------------------------------------------------------------------ [2014-10-24 06:14:15] dave at lyte dot id dot au Description: ------------ Basically if you're parsing a random HTML sometimes users will put new lines in the href attribute of a tags, browsers ignore the new line, but PHP converts it to an underscore. Test script: --------------- $ php -r 'var_export(parse_url("http://example.com/foo\nbar"));' Expected result: ---------------- The expected output is: $ php -r 'var_export(parse_url("http://example.com/foo\nbar"));' array ( 'scheme' => 'http', 'host' => 'example.com', 'path' => '/foobar', ) Actual result: -------------- The actual output is: $ php -r 'var_export(parse_url("http://example.com/foo\nbar"));' array ( 'scheme' => 'http', 'host' => 'example.com', 'path' => '/foo_bar', ) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68296&edit=1