Fix secure-http check to avoid bypass using emojis

Seldaek · Seldaek · commit fa3b9582c38f · 2024-06-10T14:48:02.000+02:00
diff --git a/src/Composer/Config.php b/src/Composer/Config.php
@@ -584,8 +584,8 @@ private function disableRepoByName(string $name): void
      */
     public function prohibitUrlByConfig(string $url, ?IOInterface $io = null, array $repoOptions = []): void
     {
-        // Return right away if the URL is malformed or custom (see issue #5173)
-        if (false === filter_var($url, FILTER_VALIDATE_URL)) {
+        // Return right away if the URL is malformed or custom (see issue #5173), but only for non-HTTP(S) URLs
+        if (false === filter_var($url, FILTER_VALIDATE_URL) && !Preg::isMatch('{^https?://}', $url)) {
             return;
         }
 
diff --git a/tests/Composer/Test/ConfigTest.php b/tests/Composer/Test/ConfigTest.php
@@ -294,6 +294,7 @@ public static function prohibitedUrlProvider(): array
             'http://packagist.org',
             'http://10.1.0.1/satis',
             'http://127.0.0.1/satis',
+            'http://💛@example.org',
             'svn://localhost/trunk',
             'svn://will.not.resolve/trunk',
             'svn://192.168.0.1/trunk',

Original file line number	Diff line number	Diff line change
`@@ -584,8 +584,8 @@ private function disableRepoByName(string $name): void`
`584`	`584`	`*/`
`585`	`585`	`public function prohibitUrlByConfig(string $url, ?IOInterface $io = null, array $repoOptions = []): void`
`586`	`586`	`{`
`587`		`- // Return right away if the URL is malformed or custom (see issue #5173)`
`588`		`- if (false === filter_var($url, FILTER_VALIDATE_URL)) {`
	`587`	`+ // Return right away if the URL is malformed or custom (see issue #5173), but only for non-HTTP(S) URLs`
	`588`	`+ if (false === filter_var($url, FILTER_VALIDATE_URL) && !Preg::isMatch('{^https?://}', $url)) {`
`589`	`589`	`return;`
`590`	`590`	`}`
`591`	`591`