Bug #81332 [Com]: urn: URIs are not validated properly

Edit report at https://bugs.php.net/bug.php?id=81332&edit=1 ID: 81332 Comment by: tamas dot nagy0404 at outlook dot com Reported by: tamas dot nagy0404 at outlook dot com Summary: urn: URIs are not validated properly Status: Not a bug Type: Bug Package: URL related Operating System: all PHP Version: Irrelevant Block user comment: N Private report: N New Comment: I see, right, I've also checked in the meanwhile. Maybe it should be emphasized in the manual that it does *not* validate an URI only URLs from the RFC? It seems like it is not clear for everyone (wasn't for me either, it is now :) ) what is the actual difference between URLs and URIs and/or why it won't validate URIs. This issue actually came up with a URI validator from a php library that uses this function and actually fails on validating URIs because of misusing the FILTER_VALIDATE_URL function for this purpose. Also there should be maybe a filter function for URIs such as FILTER_VALIDATE_URI? Should I open a feature request for that? Sorry for the inconveniences and thank you very much for your explanation. Previous Comments: ------------------------------------------------------------------------ [2021-08-05 07:54:34] requinix@php.net > I think it is still a bug (or misdocumentation), you are referring to the > http://www.faqs.org/rfcs/rfc2396.html in your manual for this > function > regardless what it is called which is about URIs, so it should either specify > that only URLs are being validated or URIs too. RFC 2396 defines the hierarchical format of a URL, which is why it's mentioned. Read section 1.2 to understand the difference between a URL and a URN. > Also... for example > news:comp.infosystems.www.servers.unix` is not a > URL either > however it passes the validation regardless. Take another look: Section 1.2 > The term "Uniform Resource Locator" (URL) refers to the subset of URI that > identify resources via a representation of their primary access mechanism (e.g., > their network "location"), rather than identifying the resource by name or by > some other attribute(s) of that resource. https://en.wikipedia.org/wiki/URL > A Uniform Resource Locator (URL), colloquially termed a web address, is a > reference to a web resource that specifies its location on a computer network > and a mechanism for retrieving it. A URL is a specific type of Uniform Resource > Identifier (URI), although many people use the two terms interchangeably. URLs > occur most commonly to reference web pages (http), but are also used for file > transfer (ftp), email (mailto), database access (JDBC), and many other > applications. So actually yes, it *is* a URL. It may not be the type of URL that most people are familiar with, like those starting with "http(s)" or containing a "www" or ".com", but it still is one. ------------------------------------------------------------------------ [2021-08-05 07:23:15] tamas dot nagy0404 at outlook dot com I think it is still a bug (or misdocumentation), you are referring to the http://www.faqs.org/rfcs/rfc2396.html in your manual for this function regardless what it is called which is about URIs, so it should either specify that only URLs are being validated or URIs too. Also... for example news:comp.infosystems.www.servers.unix` is not a URL either however it passes the validation regardless. ------------------------------------------------------------------------ [2021-08-05 07:09:58] requinix@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php https://www.php.net/manual/en/filter.filters.validate.php > Validates value as URL (according to » > http://www.faqs.org/rfcs/rfc2396), > optionally with required components. Beware a valid URL may not specify the HTTP > protocol http:// so further validation may be required to > determine the URL uses > an expected protocol, e.g. ssh:// or mailto:. Note that the > function will only > find ASCII URLs to be valid; internationalized domain names (containing non- > ASCII characters) will fail. FILTER_VALIDATE_URL validates URLs, not URIs. ------------------------------------------------------------------------ [2021-08-05 07:00:28] tamas dot nagy0404 at outlook dot com Description: ------------ Hi, Looks like the filter_var('urn:isbn:0451450523', FILTER_VALIDATE_URL); function does not validate the urn: type of URIs properly. The "urn:" type of URIs are mentioned by http://www.faqs.org/rfcs/rfc2396.html however the function just marks as invalid whereas it should validate it according to http://www.faqs.org/rfcs/rfc2141.html that is referenced from the RFC2396. Related comment: https://www.php.net/manual/en/filter.filters.validate.php#110411 Tests: https://3v4l.org/SOd9X#veol Test script: --------------- https://3v4l.org/SOd9X#veol Expected result: ---------------- I would expect to validate urn: URIs to be validated properly according to http://www.faqs.org/rfcs/rfc2141.html ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81332&edit=1