Skip to content

ext/uri: Fix GH-22628 Percent-encoding of caret in WHATWG URL paths is not performed#22700

Open
kocsismate wants to merge 2 commits into
php:PHP-8.5from
kocsismate:gh-22628-fix-caret
Open

ext/uri: Fix GH-22628 Percent-encoding of caret in WHATWG URL paths is not performed#22700
kocsismate wants to merge 2 commits into
php:PHP-8.5from
kocsismate:gh-22628-fix-caret

Conversation

@kocsismate

Copy link
Copy Markdown
Member

The caret (^) is part of the path percent-encode set:

"The path percent-encode set is a percent-encode set consisting of the query percent-encode set and U+003F (?), U+005E (^), U+0060 (`), U+007B ({), and U+007D (})."

Until now, this character wasn't percent-encoded in the path likely due to a copy-paste error. This mistake is fixed by adding LXB_URL_MAP_PATH to the lxb_url_map entry for the caret.
9682ea0

… host and non-empty userinfo

The returned error code (LXB_URL_ERROR_TYPE_INVALID_CREDENTIALS) apparently contradicts the specification:

"If atSignSeen is true and buffer is the empty string, host-missing validation error, return failure."
…s is not performed

The caret (^) is part of the path percent-encode set:

"The path percent-encode set is a percent-encode set consisting of the query percent-encode set and U+003F (?), U+005E (^), U+0060 (`), U+007B ({), and U+007D (})."

Until now, this character wasn't percent-encoded in the path likely due to a copy-paste error. This mistake is fixed by adding LXB_URL_MAP_PATH to the lxb_url_map entry for the caret.
@kocsismate kocsismate requested a review from TimWolla as a code owner July 11, 2026 19:49
@kocsismate kocsismate requested review from iluuu1994 and ndossche and removed request for TimWolla July 11, 2026 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant