[3.0] Compare URL schemes case insensitively - #9325
Open
albertlast wants to merge 1 commit into
Open
Conversation
RFC 3986, section 3.1, makes scheme names case insensitive, and this class keeps the scheme exactly as it was written rather than normalizing it. isScheme() compared the two with in_array(), so a URL written with an uppercase scheme did not match its own name. That reaches two callers. isWebsite() stops recognising HTTP:// and HTTPS:// as websites, and the avatar handling in User treats a DATA: URI as though it were a remote address. Folds both sides before comparing, and makes the comparison strict while it is there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This change was produced by an LLM. The code, the commit message and this
description were all written by Claude (Anthropic), driven by @albertlast. It has
not yet had human code review.
Everything stated below was verified by actually running it, rather than only
reasoned about. Even so, please review it as untrusted work: the diagnosis may be
right while the fix is not what SMF would prefer stylistically or architecturally.
Description
RFC 3986, section 3.1: "scheme names are case-insensitive".
SMF\Urlkeeps the schemeexactly as it was written rather than normalizing it, and
isScheme()compares the twowith
in_array():So a URL written with an uppercase scheme does not match its own name.
Two callers depend on this.
isWebsite()isisScheme(['http', 'https']), soHTTP://example.comis not recognised as a website. AndUseruses it to decidewhether an avatar value is an inline image or a remote address:
which means a
DATA:URI is treated as a remote URL.This folds both sides before comparing. The comparison is also made strict while it is
there, since
in_array()without the third argument was comparing loosely.How this was verified
PHP 8.4.23. Same script before and after:
isScheme('https')isWebsite()https://example.comHTTPS://example.comHtTp://example.comftp://example.comisScheme('data')data:image/png;base64,…DATA:image/png;base64,…Lowercase schemes, which is nearly everything in practice, behave exactly as before.
php -land PHP-CS-Fixer clean.Relationship to other PRs
Sources/Url.phpis not touched by any other open PR.Found while writing unit tests for the stateless parts of the codebase (#9326), which
carries the regression tests for this fix. This PR is independent of that one and can
be merged on its own.
Issues References (Fixes|Related|Closes)