bug #43876 [Validator] Fix validation for single level domains (HypeMC)

nicolas-grekas · nicolas-grekas · commit 382cde28c120 · 2021-11-29T16:05:42.000+01:00
This PR was merged into the 4.4 branch. Discussion ---------- [Validator] Fix validation for single level domains | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #43868, #44252 | License | MIT | Doc PR | - Not sure if there are any other test cases that could be added, but this seems to fix the problem. Commits ------- 653a21d [Validator] Fix validation for single level domains
diff --git a/src/Symfony/Component/Validator/Constraints/UrlValidator.php b/src/Symfony/Component/Validator/Constraints/UrlValidator.php
@@ -26,7 +26,13 @@ class UrlValidator extends ConstraintValidator
             (%s)://                                 # protocol
             (((?:[\_\.\pL\pN-]|%%[0-9A-Fa-f]{2})+:)?((?:[\_\.\pL\pN-]|%%[0-9A-Fa-f]{2})+)@)?  # basic auth
             (
-                ([\pL\pN\pS\-\_]+\.)*(([\pL\pN]|xn\-\-[\pL\pN-]+)+\.?) # a domain name
+                (?:
+                    (?:xn--[a-z0-9-]++\.)*+xn--[a-z0-9-]++            # a domain name using punycode
+                        |
+                    (?:[\pL\pN\pS\pM\-\_]++\.)+[\pL\pN\pM]++          # a multi-level domain name
+                        |
+                    [a-z0-9\-\_]++                                    # a single-level domain name
+                )\.?
                     |                                                 # or
                 \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}                    # an IP address
                     |                                                 # or
diff --git a/src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php b/src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php
@@ -128,6 +128,10 @@ public function getValidUrls()
             ['http://very.long.domain.name.com/'],
             ['http://localhost/'],
             ['http://myhost123/'],
+            ['http://internal-api'],
+            ['http://internal-api.'],
+            ['http://internal-api/'],
+            ['http://internal-api/path'],
             ['http://127.0.0.1/'],
             ['http://127.0.0.1:80/'],
             ['http://[::1]/'],
@@ -174,6 +178,7 @@ public function getValidUrls()
             ['http://symfony.com/#fragment'],
             ['http://symfony.com/#one_more%20test'],
             ['http://example.com/exploit.html?hello[0]=test'],
+            ['http://বিডিআইএ.বাংলা'],
         ];
     }
 
@@ -259,7 +264,14 @@ public function getInvalidUrls()
             ['http://127.0.0.1:aa/'],
             ['ftp://[::1]/'],
             ['http://[::1'],
+            ['http://☎'],
+            ['http://☎.'],
+            ['http://☎/'],
+            ['http://☎/path'],
+            ['http://hello.☎'],
+            ['http://hello.☎.'],
             ['http://hello.☎/'],
+            ['http://hello.☎/path'],
             ['http://:password@symfony.com'],
             ['http://:password@@symfony.com'],
             ['http://username:passwordsymfony.com'],
@@ -276,6 +288,9 @@ public function getInvalidUrls()
             ['http://.m.example.com'],
             ['http://wwww.example..com'],
             ['http://.www.example.com'],
+            ['http://example.co-'],
+            ['http://example.co-/path'],
+            ['http:///path'],
         ];
     }
 
