|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #73354 URL filter validator broken
Submitted: 2016-10-19 20:07 UTC Modified: 2016-10-20 09:45 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mehulmpt at gmail dot com Assigned:
Status: Verified Package: Filter related
PHP Version: Irrelevant OS: All
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: mehulmpt at gmail dot com
New email:
PHP Version: OS:


 [2016-10-19 20:07 UTC] mehulmpt at gmail dot com
filter validate URL is broken for non HTTP(s) protocols as it allows a variety of URLs to pass through though they are not valid URLs (possible XSS attacks if URL is displayed after validating)

Test script:

echo filter_var(";<script>alert()</script>", FILTER_VALIDATE_URL); // outputs JS alert box.



Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2016-10-20 01:11 UTC]
-Status: Open +Status: Verified
 [2016-10-20 09:45 UTC]
Indeed, there is an issue in php_filter_url()[1], namely that
PUNCTUATION and NATIONAL are not allowed in URLs according to RFC
1738. While these are listed in the BNF, they are never used.

However, according to the documentation FILTER_VALIDATE_URL
conforms to RFC 2396, which differs from RFC 1738.

[1] <>
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sun Apr 18 15:01:24 2021 UTC