v3.1.0 hardening: PSL wildcard/exception rules, scheme rejection, namespaced helpers - #11
Merged
Merged
Conversation
…me rejection, namespaced helpers Security / correctness: - Validator: implement Public Suffix List wildcard (*) and exception (!) rule handling per the PSL algorithm (prevailing rule is the exception rule if any, otherwise the longest match; an exception rule's suffix is the rule minus its leftmost label). Applies to both ICANN and private sections; the private check is label-wise and exception-aware. - HostParser: detect any RFC 3986 scheme with an anchored pattern and throw InvalidArgumentException for non-http/https schemes instead of mis-parsing (ftp://a.com used to yield the host 'ftp'). Dropped the misleading exception code 500. - PublicSuffixListParser: split section content on explicit newlines (\R in byte mode also matches 0x85, corrupting multi-byte UTF-8 labels such as 嘉里大酒店); spec-correct rule-line filtering instead of unset($lines[0]); NUL-byte end-of-rule sentinel that cannot collide with list content; rule lines containing NUL are discarded. Changed: - Helper functions moved to DomainValidity\Support; the old global names remain as deprecated function_exists-guarded shims (src/functions_global.php), removing the fatal redeclaration risk. - Factory is now final (matches documented API); bogus @throws removed. - composer.json: hardcoded version field removed; psl:update script added to refresh the test-only PSL snapshot. - CI: runs on pushes to 3.x, actions/checkout@v4, Dependabot for Composer and GitHub Actions; PHPCS now lints tests/. - Dev deps: squizlabs/php_codesniffer 3.13.5 -> 3.13.6 (CVE-2026-67434). Tests: 40 -> 88; new coverage for the PSL parser, helper functions, wildcard/exception rules, Host serialization, and edge-case inputs (ports, userinfo, IP literals, trailing dots, empty input). Docs: USAGE.md (wildcard/exception behavior, scheme policy, IDN limitations), CHANGELOG.md 3.1.0 entry, SECURITY.md advisory note.
adrorocker
force-pushed
the
security/v3.1.0-hardening
branch
from
August 14, 2026 17:11
0f4697b to
df310d1
Compare
php-actions/composer@v6 runs composer inside its own container (PHP 8.5), ignoring the version selected by shivammathur/setup-php, so dependencies were resolved against the wrong PHP version. Run composer directly on the runner instead, where the matrix PHP is active.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Full-audit hardening pass for v3.1.0. All existing behavior for previously-valid inputs is preserved; existing tests untouched and green.
Security / correctness
*) and exception (!) rules are now fully supported.findTldInHierarchyonly did exact-label lookups, ignoring 200+ wildcard rules and all 8 exception rules — consumers could derive a wrong registrable domain (hazard for cookie scoping / host allowlisting).foo.bar.cknow resolves suffixbar.ck;www.ckresolvesck(exception prevails). Private section gains!support too.InvalidArgumentExceptioninstead of mis-parsing (ftp://a.comused to yield hostftp).\Rin byte mode (which also matches0x85, a byte inside labels like嘉里大酒店).unset($lines[0]).Changed
DomainValidity\Support; old global names kept as deprecatedfunction_exists-guarded shims (fatal redeclaration risk gone, removal planned for v4.0).Factorynowfinal(matches docs); bogus@throwsremoved; exception code 500 dropped.versionfield removed;psl:updatescript added.3.xpushes,checkout@v4, Dependabot added, PHPCS lintstests/.Tests
40 → 88. New coverage: PSL parser, helpers, wildcard/exception rules,
Hostserialization, edge inputs (ports, userinfo, IP literals, trailing dots, empty string).composer check(phpcs + phpstan level 8 + pest) green on PHP 8.2.