[PEAR-BUG] Bug #20418 [Asn->Csd]: Incorrect normalization of URI with missing authority

Edit report at https://pear.php.net/bugs/bug.php?id=20418&edit=1

 ID:               20418
 Updated by:       [email protected]
 Reported By:      jan dot prachar at gmail dot com
 Summary:          Incorrect normalization of URI with missing authority
-Status:           Assigned
+Status:           Closed
 Type:             Bug
 Package:          Net_URL2
 Package Version:  2.0.7
 PHP Version:      Irrelevant
 Assigned To:      tkli
 Roadmap Versions: 
 New Comment:

-Status: Assigned
+Status: Closed
Thank you for your bug report. This issue has been fixed
in the latest released version of the package, which you can download at
http://pear.php.net/get/




Previous Comments:
------------------------------------------------------------------------

[2014-10-08 12:30:10] tkli

-Status: Feedback
+Status: Open
I found the flaw within Net_URL2::normalize().

The reason is the same as it was in #20385, that time it was only fixed
for userinfo, so a shortcoming.

This will be fixed in the next release.

------------------------------------------------------------------------

[2014-10-08 11:19:43] pracj3am

I would just leave authority missing during normalization (i.e. _host =
false).

We have service that downloads many diverse web pages from internet. It
happened we came to redirect location like http:g. We normalize URL
before saving, so it was saved as http:///g which is obviusly
non-existent URL. It was strange that browser handled redirect
differently and went to existing URL like http://h/g. So we found out we
should set Net_URL2 option OPTION_STRICT to false. But there remained
issue with normalization which is imho bug.

------------------------------------------------------------------------

[2014-10-08 01:40:55] tkli

you're right my description was not very good.

"http:g" is a valid URI

scheme: "http"
path-rootless: "g"

so this is not a validation issue. I was wrong on that part.

not yet sure how normalization should work here.

how did you run over this issue?

------------------------------------------------------------------------

[2014-10-08 01:21:09] pracj3am

I don't understand, http:g is completely valid URI, isn't?
Another examples:

> echo (new
Net_URL2('mailto:[email protected]'))->getNormalizedURL();
mailto:///[email protected]

> echo (new
Net_URL2('urn:oasis:names:specification:docbook:dtd:xml:4.1.2'))->getNormalizedURL();
urn:///oasis:names:specification:docbook:dtd:xml:4.1.2

------------------------------------------------------------------------

[2014-10-08 00:45:45] tkli

-Status:      Open
+Status:      Feedback
-Assigned To:
+Assigned To: tkli
"http:g" is not a valid URI.

the parser within Net_URL2 is lax accepting this as input (e.g. within
the ctor) and (as best guess) maps the end "g" to 
the path component (actually treating the malformed hier-part as path
component).

for the case you bring up here - the "missing authority" - normalization
can only follow the rules as outlined in RFC 3986 
Section 6. Normalization and Comparison. these are based upon what the
ctor has initialized as URI parts then.

as such URI normalization needs to create a "valid" URI (which is not a
valid HTTP scheme URI, it does not have a by 
scheme federated empty authority as you correctly noted, compare #20304
for the file scheme) and "http:g" is not such 
a valid URI, it *can not be* the expected result of
Net_URL2::getNormalizedURL().

this in its own would qualify your report as invalid, however this does
not resolve the underlying problem for you that 
Net_URL2 does not validate URIs (it parses those and it does
normalization).

compare with your other report #20421.

if you can share why you expected that result (in the other report you
wrote you want to see an exception thrown, with 
such a feature, this must have happened already when instantiating
Net_URL2 for the example you give in this report). 
with some more context, it might be easier to understand for me.

feedback welcome.

-- tk

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://pear.php.net/bugs/bug.php?id=20418

-- 
Edit this bug report at https://pear.php.net/bugs/bug.php?id=20418&edit=1