search

beberlei / assert

Thin assertion library for use in libraries and business-model
Other
2.41k stars 186 forks source link

Assertion::url validates invalid domain names #311

Open p4veI opened 3 years ago

p4veI commented 3 years ago

I've come across an issue where Assertion::url() method validates an invalid url.

I've passed http://whatever through this method without including a top level domain name e.g. .com etc. I feel like this is an invalid domain, however maybe I'm missing something as the pattern is quite extensive.

I've pasted the pattern here and included some examples, the first example I think should not pass the regex.

EDIT: I've also opened up an issue for symfony/validator as it seems the pattern from that library has been used here - so now I understand this passes so e.g. http://localhost can pass or some other internal urls on LAN, but just as I stated in comments there.. feels like this validation is completely useless while trying to validate for both. It's more useful for ipv4/ipv6 validation than actual urls with TLD host extensions.

SeredOFF commented 3 years ago

Also Assertion::url() method skips invalid hostnames:

  1. http://www.ex=ample.com - invalid characters,
  2. https://www.EXAMPLE.cOm - hostname must be in lowercase.