PHP's parse_url() implementation, and the MediaWiki helper UrlUtils::parse() that builds on it, have various inaccuracies compared to how browsers parse weird or malformed URLs. PHP 8.5 has Uri\WhatWg\Url which follows the same specification as modern browsers, and for older versions there's a polyfill. We should replace all calls.
Codesearch:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| In Progress | Tgr | T433771 Replace UrlUtils::parse() and parse_url() with Uri\WhatWg\Url | |||
| Open | None | T433772 Replace UrlUtils::parse() and parse_url() with Uri\WhatWg\Url in MWP-owned components | |||
| Open | None | T435696 Application Security Review Request : WHATWG URI polyfill Composer library (league/uri-polyfill or mensbeam/uri) |
Or maybe in the case of UrlUtils::parse(), it should just be updated to use the WhatWG compliant method. It would be a change in behavior, but probably only in cases where the old behavior was worse.
@Krinkle asked whether the Symfony polyfill already supports this (in which case we could avoid adding a new package), which is a good question but according to their list of supported features, it doesn't.
Dependency tree:
Not too bad. The rowbot stuff is the actual spec logic, the polyfill package mostly just defines interfaces.
Another option is mensbeam/uri-polyfill. That one only depends on an intl package from the same author.
(The third used to be bakame-php/aide-uri but it was abandoned in favor of the league polyfill; searcging packagist and github didn't bring up further options).
Change #1328290 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/vendor@master] [POC] Add mensbeam/uri (WHATWG URI polyfill)
Change #1328295 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/vendor@master] [POC] Add league/uri-polyfill (WHATWG URI polyfill)
Change #1328302 had a related patch set uploaded (by Gergő Tisza; author: tgr):
[mediawiki/core@master] [POC] Use WHATWG URI parsing