From fc0e725f895d5c63c7b413ecaff0cfce0657c0bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
Date: Fri, 17 Oct 2025 23:13:11 +0200
Subject: [PATCH] ext/uri:  Fix the distinction between an empty and a missing
 query/fragment for WHATWG URLs

---
 NEWS                                          |  3 +++
 .../fragment_success_hashmark.phpt            | 19 +++++++++++++++++++
 .../query_success_question_mark.phpt          | 19 +++++++++++++++++++
 ext/uri/uri_parser_whatwg.c                   |  8 ++++----
 4 files changed, 45 insertions(+), 4 deletions(-)
 create mode 100644 ext/uri/tests/whatwg/modification/fragment_success_hashmark.phpt
 create mode 100644 ext/uri/tests/whatwg/modification/query_success_question_mark.phpt

diff --git a/NEWS b/NEWS
index 353df7d7a8921..7378ae2538bff 100644
--- a/NEWS
+++ b/NEWS
@@ -38,6 +38,9 @@ PHP                                                                        NEWS
 - URI:
   . Fixed bug GH-20088 (Heap-use-after-free in PHP URI WHATWG parser
     during malformed URL processing). (lexborisov)
+  . Fixed the distinction between an empty and a missing query/fragment
+    when using Uri\WhatWg\Url::getQuery() and Uri\WhatWg\Url::getFragment().
+    (kocsismate)
 
 09 Oct 2025, PHP 8.5.0RC2
 
diff --git a/ext/uri/tests/whatwg/modification/fragment_success_hashmark.phpt b/ext/uri/tests/whatwg/modification/fragment_success_hashmark.phpt
new file mode 100644
index 0000000000000..4639d993df04d
--- /dev/null
+++ b/ext/uri/tests/whatwg/modification/fragment_success_hashmark.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Test Uri\WhatWg\Url component modification - fragment - only a hashmark character
+--EXTENSIONS--
+uri
+--FILE--
+<?php
+
+$url1 = Uri\WhatWg\Url::parse("https://example.com");
+$url2 = $url1->withFragment("#");
+
+var_dump($url1->getFragment());
+var_dump($url2->getFragment());
+var_dump($url2->toAsciiString());
+
+?>
+--EXPECT--
+NULL
+string(0) ""
+string(21) "https://example.com/#"
diff --git a/ext/uri/tests/whatwg/modification/query_success_question_mark.phpt b/ext/uri/tests/whatwg/modification/query_success_question_mark.phpt
new file mode 100644
index 0000000000000..3e1bf5ab9dce5
--- /dev/null
+++ b/ext/uri/tests/whatwg/modification/query_success_question_mark.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Test Uri\WhatWg\Url component modification - query - only a question mark character
+--EXTENSIONS--
+uri
+--FILE--
+<?php
+
+$url1 = Uri\WhatWg\Url::parse("https://example.com");
+$url2 = $url1->withQuery("?");
+
+var_dump($url1->getQuery());
+var_dump($url2->getQuery());
+var_dump($url2->toAsciiString());
+
+?>
+--EXPECT--
+NULL
+string(0) ""
+string(21) "https://example.com/?"
diff --git a/ext/uri/uri_parser_whatwg.c b/ext/uri/uri_parser_whatwg.c
index fab228a2d70cf..20507a0faf1b3 100644
--- a/ext/uri/uri_parser_whatwg.c
+++ b/ext/uri/uri_parser_whatwg.c
@@ -278,7 +278,7 @@ static zend_result php_uri_parser_whatwg_username_read(void *uri, php_uri_compon
 {
 	const lxb_url_t *lexbor_uri = uri;
 
-	if (lexbor_uri->username.length) {
+	if (lexbor_uri->username.length > 0) {
 		ZVAL_STRINGL(retval, (const char *) lexbor_uri->username.data, lexbor_uri->username.length);
 	} else {
 		ZVAL_NULL(retval);
@@ -425,7 +425,7 @@ static zend_result php_uri_parser_whatwg_path_read(void *uri, php_uri_component_
 {
 	const lxb_url_t *lexbor_uri = uri;
 
-	if (lexbor_uri->path.str.length) {
+	if (lexbor_uri->path.str.length > 0) {
 		ZVAL_STRINGL(retval, (const char *) lexbor_uri->path.str.data, lexbor_uri->path.str.length);
 	} else {
 		ZVAL_EMPTY_STRING(retval);
@@ -454,7 +454,7 @@ static zend_result php_uri_parser_whatwg_query_read(void *uri, php_uri_component
 {
 	const lxb_url_t *lexbor_uri = uri;
 
-	if (lexbor_uri->query.length) {
+	if (lexbor_uri->query.data != NULL) {
 		ZVAL_STRINGL(retval, (const char *) lexbor_uri->query.data, lexbor_uri->query.length);
 	} else {
 		ZVAL_NULL(retval);
@@ -483,7 +483,7 @@ static zend_result php_uri_parser_whatwg_fragment_read(void *uri, php_uri_compon
 {
 	const lxb_url_t *lexbor_uri = uri;
 
-	if (lexbor_uri->fragment.length) {
+	if (lexbor_uri->fragment.data != NULL) {
 		ZVAL_STRINGL(retval, (const char *) lexbor_uri->fragment.data, lexbor_uri->fragment.length);
 	} else {
 		ZVAL_NULL(retval);