[php-src] Issue #22608: ext/uri: RFC 3986 initial-double-dot path can yield incorrect normalization
[email protected] (JKingweb) Sun, 5 Jul 2026 14:40:55 +0000
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22608
Author: JKingweb
### Description
The following code:
```php
echo new Uri\Rfc3986\Uri("foo:.///bar")->toString()."\n";
echo new Uri\Rfc3986\Uri("foo:.///bar")->getPath()."\n";
echo new Uri\Rfc3986\Uri("foo:..///bar")->toString()."\n";
echo new Uri\Rfc3986\Uri("foo:..///bar")->getPath()."\n";
<?php
```
Resulted in this output:
```
foo:.///bar
.///bar
foo://bar
//bar
```
But I expected this output instead:
```
foo:.///bar
.///bar
foo:.///bar
.///bar
```
For the uninitiated, an initial double-slash path in a URI without an authority is impossible. The `getPath()` method returns a normalized representation which collapses dot-paths, but because this URI has no authority the `getPath()` method should be taking extra care to ensure the normalized path does not begin with two slashes creating an authority out of thin air.
I'm uncertain if this is a PHP bug or a uriparser bug. There is no PHP test covering this case as far as I can tell.
### PHP Version
```plain
PHP 8.5.8 (cli) (built: Jul 1 2026 16:35:50) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.5.8, Copyright (c) Zend Technologies
with Zend OPcache v8.5.8, Copyright (c), by Zend Technologies
```
### Operating System
Arch Linux