Description:
------------
Similarly to https://bugs.php.net/bug.php?id=73192, parse_url parsing mismatches the parsing of the curl module.  By crafting a special url like "badwebsite.com:/secrets.php", parse_url will parse and return "badwebsite.com" as the schema, while curl will execute with "badwebsite.com" as the hostname.  For sites filtering on parse_url hostname, this could be seen as a security issue/bypass.  See the test script for an example. 

Test script:
---------------
$blacklist = array("google.com", "badwebsite.com");

$url = $_GET['url']; /* url=badwebsite.com:/secrets.php */
$parsed = parse_url($url);

if (isset($parsed['host']) && in_array($parsed['host'], $blacklist))
{
    echo "bad hacker";
    exit();
}

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_COOKIE, "nuke_launch_codes=31-133-37");
curl_exec($ch);
curl_close($ch);


Expected result:
----------------
With url=badwebsite.com:/secrets.php, the expected result should be "bad hacker."

Actual result:
--------------
With url=badwebsite.com:/secrets.php, the actual result is the HTML of badwebsite.com/secrets.php