bug #24589 Username and password in basic auth are allowed to contain '.' (Richard Quadling)

fabpot · fabpot · commit 5c8366b2da1d · 2017-10-18T07:25:02.000-07:00
This PR was merged into the 2.7 branch. Discussion ---------- Username and password in basic auth are allowed to contain '.' Initially reported by Fede Isas in beberlei/assert#234 | Q | A | ------------- | --- | Branch? | 2.3 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | Commits ------- e5d57dd050 Username and password in basic auth are allowed to contain '.'
diff --git a/Constraints/UrlValidator.php b/Constraints/UrlValidator.php
@@ -23,7 +23,7 @@ class UrlValidator extends ConstraintValidator
 {
     const PATTERN = '~^
             (%s)://                                 # protocol
-            (([\pL\pN-]+:)?([\pL\pN-]+)@)?          # basic auth
+            (([\.\pL\pN-]+:)?([\.\pL\pN-]+)@)?      # basic auth
             (
                 ([\pL\pN\pS-\.])+(\.?([\pL\pN]|xn\-\-[\pL\pN-]+)+\.?) # a domain name
                     |                                                 # or
diff --git a/Tests/Constraints/UrlValidatorTest.php b/Tests/Constraints/UrlValidatorTest.php
@@ -121,6 +121,9 @@ public function getValidUrls()
             array('http://xn--d1abbgf6aiiy.xn--p1ai/'),
             array('http://☎.com/'),
             array('http://username:password@symfony.com'),
+            array('http://user.name:password@symfony.com'),
+            array('http://username:pass.word@symfony.com'),
+            array('http://user.name:pass.word@symfony.com'),
             array('http://user-name@symfony.com'),
             array('http://symfony.com?'),
             array('http://symfony.com?query=1'),

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ class UrlValidator extends ConstraintValidator`
`23`	`23`	`{`
`24`	`24`	`const PATTERN = '~^`
`25`	`25`	`(%s):// # protocol`
`26`		`- (([\pL\pN-]+:)?([\pL\pN-]+)@)? # basic auth`
	`26`	`+ (([\.\pL\pN-]+:)?([\.\pL\pN-]+)@)? # basic auth`
`27`	`27`	`(`
`28`	`28`	`([\pL\pN\pS-\.])+(\.?([\pL\pN]\|xn\-\-[\pL\pN-]+)+\.?) # a domain name`
`29`	`29`	`\| # or`
-Original file line number
+Diff line change
             array('http://xn--d1abbgf6aiiy.xn--p1ai/'),
             array('http://☎.com/'),
             array('http://username:[email protected]'),
 +            array('http://user.name:[email protected]'),
 +            array('http://username:[email protected]'),
 +            array('http://user.name:[email protected]'),
             array('http://[email protected]'),
             array('http://symfony.com?'),
             array('http://symfony.com?query=1'),