symfony
diff --git a/‎src/Symfony/Component/Validator/Constraints/UrlValidator.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Validator/Constraints/UrlValidator.php
+3-1Lines changed: 3 additions & 1 deletion b/‎src/Symfony/Component/Validator/Constraints/UrlValidator.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Validator/Constraints/UrlValidator.php
+3-1Lines changed: 3 additions & 1 deletion
diff --git a/‎src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php
+4Lines changed: 4 additions & 0 deletions b/‎src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php
Copy file name to clipboardExpand all lines: src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php
+4Lines changed: 4 additions & 0 deletions
@@ -34,7 +34,9 @@ class UrlValidator extends ConstraintValidator
                 \]  # an IPv6 address
             )
             (:[0-9]+)?                              # a port (optional)
-            (/?|/\S+|\?\S*|\#\S*)                   # a /, nothing, a / with something, a query or a fragment
+            (?:/ (?:[\pL\pN\-._\~!$&\'()*+,;=:@]|%%[0-9A-Fa-f]{2})* )*      # a path
+            (?:\? (?:[\pL\pN\-._\~!$&\'()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )?   # a query (optional)
+            (?:\# (?:[\pL\pN\-._\~!$&\'()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )?   # a fragment (optional)
         $~ixu';
 
     /**
 
@@ -128,6 +128,7 @@ public function getValidUrls()
             array('http://symfony.com#'),
             array('http://symfony.com#fragment'),
             array('http://symfony.com/#fragment'),
+            array('http://symfony.com/#one_more%20test'),
         );
     }
 
@@ -167,6 +168,9 @@ public function getInvalidUrls()
             array('http://:password@@symfony.com'),
             array('http://username:passwordsymfony.com'),
             array('http://usern@me:password@symfony.com'),
+            array('http://example.com/exploit.html?<script>alert(1);</script>'),
+            array('http://example.com/exploit.html?hel lo'),
+            array('http://example.com/exploit.html?not_a%hex'),
         );
     }