URL validation constraint allows angled brackets

[courtney-miles]

Q	A
Bug report?	yes
Feature request?	no
BC Break report?	no
RFC?	no
Symfony version	3.1.5

The URL validator (\Symfony\Component\Validator\Constraints\UrlValidator) will not report a violation for the following URL

http://example.com/exploit.html?<script>alert(1);</script>

I believe the specification requires that < and > must be URL encoded.

In comparison, the filter_var() will not reject the URL, but it returns a copy of the URL with everything from < stripped.

[Nek-]

Confirmed. The following code reproduce the problem:

<?php
use Symfony\Component\Validator\Constraints;

$validator = new Constraints\UrlValidator();
$const = new Constraints\Url();

// null instead of error because there is no context to build a violation
var_dump($validator->validate('http://example.com/exploit.html?<script>alert(1);</script>', $const));

An easy test update is adding this URL here: https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Validator/Tests/Constraints/UrlValidatorTest.php#L149

The URI RFC reference that not all chars are supported

Also this is an obvious problem for re-rending URLs in templating.