php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #73354 URL filter validator broken
Submitted: 2016-10-19 20:07 UTC Modified: 2016-10-20 09:45 UTC
Votes:3
Avg. Score:2.3 ± 0.9
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mehulmpt at gmail dot com Assigned:
Status: Verified Package: Filter related
PHP Version: Irrelevant OS: All
Private report: No CVE-ID: None
View Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
MUST BE VALID
Solve the problem:
9 + 21 = ?
Subscribe to this entry?

 
 [2016-10-19 20:07 UTC] mehulmpt at gmail dot com 
Description:
------------
filter validate URL is broken for non HTTP(s) protocols as it allows a variety of URLs to pass through though they are not valid URLs (possible XSS attacks if URL is displayed after validating)

Test script:
---------------
<?php

echo filter_var("ftp://oscarotero.com;<script>alert()</script>", FILTER_VALIDATE_URL); // outputs JS alert box.

?>

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-10-20 01:11 UTC] yohgaki@php.net
-Status: Open +Status: Verified
 [2016-10-20 09:45 UTC] cmb@php.net 
Indeed, there is an issue in php_filter_url()[1], namely that
PUNCTUATION and NATIONAL are not allowed in URLs according to RFC
1738. While these are listed in the BNF, they are never used.

However, according to the documentation FILTER_VALIDATE_URL
conforms to RFC 2396, which differs from RFC 1738.

[1] <http://lxr.php.net/source/xref/PHP-MASTER/ext/filter/sanitizing_filters.c#php_filter_url>
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri May 09 09:01:26 2025 UTC