From 40dc4c89df479d6a328eeeabfe160d251facc724 Mon Sep 17 00:00:00 2001 From: Emmanuel BORGES Date: Tue, 19 Mar 2019 17:21:05 +0100 Subject: [PATCH] [Validator] allow brackets in the optional query string --- .../Component/Validator/Constraints/UrlValidator.php | 6 +++--- .../Validator/Tests/Constraints/UrlValidatorTest.php | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/Symfony/Component/Validator/Constraints/UrlValidator.php b/src/Symfony/Component/Validator/Constraints/UrlValidator.php index 20d8ded87069e..ff1925e9e1272 100644 --- a/src/Symfony/Component/Validator/Constraints/UrlValidator.php +++ b/src/Symfony/Component/Validator/Constraints/UrlValidator.php @@ -35,9 +35,9 @@ class UrlValidator extends ConstraintValidator \] # an IPv6 address ) (:[0-9]+)? # a port (optional) - (?:/ (?:[\pL\pN\-._\~!$&\'()*+,;=:@]|%%[0-9A-Fa-f]{2})* )* # a path - (?:\? (?:[\pL\pN\-._\~!$&\'()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )? # a query (optional) - (?:\# (?:[\pL\pN\-._\~!$&\'()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )? # a fragment (optional) + (?:/ (?:[\pL\pN\-._\~!$&\'()*+,;=:@]|%%[0-9A-Fa-f]{2})* )* # a path + (?:\? (?:[\pL\pN\-._\~!$&\'\[\]()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )? # a query (optional) + (?:\# (?:[\pL\pN\-._\~!$&\'()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )? # a fragment (optional) $~ixu'; /** diff --git a/src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php b/src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php index 47b723311311e..f065aa19a7210 100644 --- a/src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php +++ b/src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php @@ -151,6 +151,7 @@ public function getValidUrls() ['http://symfony.com#fragment'], ['http://symfony.com/#fragment'], ['http://symfony.com/#one_more%20test'], + ['http://example.com/exploit.html?hello[0]=test'], ]; }