Bug #63162 - parse_url does not matches password component

[husman]

Here is a fix for Bug #63162 - parse_url does not matches password component. Here is a link to the original bug post:

https://bugs.php.net/bug.php?id=63162

The source of error is in the function php_url_parse_ex, which is in the file: ext/standard/url.c.

The function starts with a pointer to the beginning of the input string and scans up to the memory location of the first occurrence of the character ';'. If the input string is: //user:pass@host, then the if condition within the the "parse scheme" section is met due to the fact that / is non-alpha, non-digit, and is not in the set <+, ., ->, therefore, the goto parse_port is triggered. parse_port begins at an offset one (+1) greater than the location of ';'. However, this region is expecting numeric characters for the next 6 digits so it loops 6 times with no hit, due to the fact that we do not have a numeric value after ';'. The next "if" condition is also not met due to the fact that pp was never incremented in the while loop above. therefore, we hit the else-if and else. The first else-if is not meant due to the fact that our string has not yet terminated. Finally, the second else if contains the fix to test if we made a bad assumption that the port is expected.

Here are the results/output before the fix:

// input = http://user:pass@host
Array
(
[scheme] => http
[host] => host
[user] => user
[pass] => pass
)

// input = //user:pass@host
Array
(
[path] => //user:pass@host
)

// input = //user@host
Array
(
[host] => host
[user] => user
)

Here are the results/output after the fix:

// input = http://user:pass@host
Array
(
[scheme] => http
[host] => host
[user] => user
[pass] => pass
)

// input = //user:pass@host
Array
(
[host] => host
[user] => user
[pass] => pass
)

// input = //user@host
Array
(
[host] => host
[user] => user
)

I hope this helps. Thanks!

[laruence]

A test script(.phpt) is needed, thanks

[husman]

Hey Laruence, I just committed bug63162.phpt to tests/output/bug63162.phpt. Thanks for the notice and sorry for the delay.

[php-pulls]

Comment on behalf of stas at php.net:

merged