symfony · alexandre-daubois · Jan 15, 2025
diff --git a/src/Symfony/Component/DependencyInjection/EnvVarProcessor.php b/src/Symfony/Component/DependencyInjection/EnvVarProcessor.php
@@ -313,7 +313,7 @@ public function getEnv(string $prefix, string $name, \Closure $getEnv): mixed
             if (('\\' !== \DIRECTORY_SEPARATOR || 'file' !== $params['scheme']) && false !== ($i = strpos($env, '\\')) && $i < strcspn($env, '?#')) {
                 throw new RuntimeException(\sprintf('Invalid URL in env var "%s": backslashes are not allowed.', $name));
             }
-            if (\ord($env[0]) <= 32 || \ord($env[-1]) <= 32 || \strlen($env) !== strcspn($env, "\r\n\t")) {
+            if (\ord($env[0]) <= 32 || \ord($env[-1]) <= 32 || \strlen($env) !== strcspn($env, "\r\n\t\v")) {
                 throw new RuntimeException(\sprintf('Invalid URL in env var "%s": leading/trailing ASCII control characters or whitespaces are not allowed.', $name));
             }
             $params += [

diff --git a/src/Symfony/Component/DependencyInjection/Tests/EnvVarProcessorTest.php b/src/Symfony/Component/DependencyInjection/Tests/EnvVarProcessorTest.php
@@ -1002,6 +1002,7 @@ public static function provideGetEnvUrlPath()
      *           ["a\rb"]
      *           ["a\nb"]
      *           ["a\tb"]
+     *           ["a\u000bb"]
      *           ["\u0000foo"]
      *           ["foo\u0000"]
      *           [" foo"]

diff --git a/src/Symfony/Component/HttpClient/HttpClientTrait.php b/src/Symfony/Component/HttpClient/HttpClientTrait.php
@@ -640,7 +640,7 @@ private static function parseUrl(string $url, array $query = [], array $allowedS
         if (false !== ($i = strpos($url, '\\')) && $i < strcspn($url, '?#')) {
             throw new InvalidArgumentException(\sprintf('Malformed URL "%s": backslashes are not allowed.', $url));
         }
-        if (\strlen($url) !== strcspn($url, "\r\n\t")) {
+        if (\strlen($url) !== strcspn($url, "\r\n\t\v")) {
             throw new InvalidArgumentException(\sprintf('Malformed URL "%s": CR/LF/TAB characters are not allowed.', $url));
         }
         if ('' !== $url && (\ord($url[0]) <= 32 || \ord($url[-1]) <= 32)) {

diff --git a/src/Symfony/Component/HttpClient/Tests/HttpClientTraitTest.php b/src/Symfony/Component/HttpClient/Tests/HttpClientTraitTest.php
@@ -253,6 +253,7 @@ public function testResolveBaseUrlWithoutScheme()
      *           ["a\rb"]
      *           ["a\nb"]
      *           ["a\tb"]
+     *           ["a\u000bb"]
      *           ["\u0000foo"]
      *           ["foo\u0000"]
      *           [" foo"]

diff --git a/src/Symfony/Component/Routing/RequestContext.php b/src/Symfony/Component/Routing/RequestContext.php
@@ -50,7 +50,7 @@ public static function fromUri(string $uri, string $host = 'localhost', string $
         if (false !== ($i = strpos($uri, '\\')) && $i < strcspn($uri, '?#')) {
             $uri = '';
         }
-        if ('' !== $uri && (\ord($uri[0]) <= 32 || \ord($uri[-1]) <= 32 || \strlen($uri) !== strcspn($uri, "\r\n\t"))) {
+        if ('' !== $uri && (\ord($uri[0]) <= 32 || \ord($uri[-1]) <= 32 || \strlen($uri) !== strcspn($uri, "\r\n\t\v"))) {
             $uri = '';
         }
 

diff --git a/src/Symfony/Component/Routing/Tests/RequestContextTest.php b/src/Symfony/Component/Routing/Tests/RequestContextTest.php
@@ -91,6 +91,7 @@ public function testFromUriBeingEmpty()
      *           ["a\rb"]
      *           ["a\nb"]
      *           ["a\tb"]
+     *           ["a\u000bb"]
      *           ["\u0000foo"]
      *           ["foo\u0000"]
      *           [" foo"]