Allow URL-encoded special characters in basic auth part of URLs

Resolves: symfony/symfony#36285

Author: cweiske

Constraints/UrlValidator.php

@@ -23,7 +23,7 @@ class UrlValidator extends ConstraintValidator
 {
     const PATTERN = '~^
             (%s)://                                 # protocol
-            (([\_\.\pL\pN-]+:)?([\_\.\pL\pN-]+)@)?  # basic auth
+            (((?:[\_\.\pL\pN-]|%%[0-9A-Fa-f]{2})+:)?((?:[\_\.\pL\pN-]|%%[0-9A-Fa-f]{2})+)@)?  # basic auth
             (
                 ([\pL\pN\pS\-\_\.])+(\.?([\pL\pN]|xn\-\-[\pL\pN-]+)+\.?) # a domain name
                     |                                                 # or

Tests/Constraints/UrlValidatorTest.php

@@ -122,6 +122,8 @@ public function getValidUrls()
             ['http://user.name:[email protected]'],
             ['http://[email protected]'],
             ['http://[email protected]'],
+            ['http://u%24er:[email protected]'],
+            ['http://user:pa%24%[email protected]'],
             ['http://symfony.com?'],
             ['http://symfony.com?query=1'],
             ['http://symfony.com/?query=1'],
@@ -168,6 +170,8 @@ public function getInvalidUrls()
             ['http://:password@@symfony.com'],
             ['http://username:passwordsymfony.com'],
             ['http://usern@me:[email protected]'],
+            ['http://nota%hex:[email protected]'],
+            ['http://username:nota%[email protected]'],
             ['http://example.com/exploit.html?<script>alert(1);</script>'],
             ['http://example.com/exploit.html?hel lo'],
             ['http://example.com/exploit.html?not_a%hex'],