Commit b84bd9ef3c8 for php.net
commit b84bd9ef3c800e8fa9e6314c58683ec27bc14aa2
Merge: c6c8db5a006 c025bc47dbb
Author: Tim Düsterhus <tim@bastelstu.be>
Date: Sun Jul 12 20:53:05 2026 +0200
Merge branch 'PHP-8.5'
* PHP-8.5:
ext/uri: Fix GH-22628 Percent-encoding of caret in WHATWG URL paths is not performed (#22700)
diff --cc NEWS
index f8fcd3556d1,a4f1a24223e..48b13b5bc90
--- a/NEWS
+++ b/NEWS
@@@ -81,23 -89,23 +81,25 @@@ PH
. Fixed bug GH-21314 (Different session garbage collector behavior between
PHP 8.3 and PHP 8.5). (jorgsowa)
-- SPL:
- . Fix class_parents for classes with leading slash in non-autoload mode.
- (jorgsowa)
- . Ignore leading back-slash in class_parents(), class_implements(), and
- class_uses(). (jorgsowa)
- . Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object
- segfaults). (iliaal)
+- SOAP:
+ . Fixed bug GH-22585 (OOM on bailout with uninitialized
+ do_request() parameters). (David Carlier)
+ . Fixed xsd:hexBinary decoding to reject odd-length values instead of
+ silently truncating the last nibble. (Weilin Du)
- Standard:
- . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
- (Weilin Du)
+ . Fixed sleep() and usleep() to reject values that overflow the underlying
+ unsigned int timeout. (Weilin Du)
+ . Fixed bug GH-22671 (assert.bail aborts the process when the assert callback
+ throws an exception whose reporting re-throws). (iliaal)
+
+- Streams:
+ . Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL
+ and a proxy set). (CVE-2026-12184) (ndossche)
- URI:
- . Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty
- opaque hosts. (kocsismate)
+ . Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not
+ performed). (kocsismate)
. Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and
non-empty userinfo). (kocsismate)
diff --cc ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch
index 53359883782,53359883782..f23ec0f5034
--- a/ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch
+++ b/ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 26 Aug 2023 15:08:59 +0200
--Subject: [PATCH 01/10] Expose line and column information for use in PHP
++Subject: [PATCH 01/11] Expose line and column information for use in PHP
---
source/lexbor/dom/interfaces/node.h | 2 ++
diff --cc ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch
index 8814d595535,8814d595535..8758c09a2e8
--- a/ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch
+++ b/ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Mon, 14 Aug 2023 20:18:51 +0200
--Subject: [PATCH 02/10] Track implied added nodes for options use in PHP
++Subject: [PATCH 02/11] Track implied added nodes for options use in PHP
---
source/lexbor/html/tree.h | 3 +++
diff --cc ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch
index aa480232049,aa480232049..56458a49dee
--- a/ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch
+++ b/ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Thu, 24 Aug 2023 22:57:48 +0200
--Subject: [PATCH 03/10] Patch utilities and data structure to be able to
++Subject: [PATCH 03/11] Patch utilities and data structure to be able to
generate smaller lookup tables
Changed the generation script to check if everything fits in 32-bits.
diff --cc ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch
index 1a28b21ccdc,1a28b21ccdc..f4fe2050998
--- a/ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch
+++ b/ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 29 Nov 2023 21:26:47 +0100
--Subject: [PATCH 04/10] Remove unused upper case tag static data
++Subject: [PATCH 04/11] Remove unused upper case tag static data
---
source/lexbor/tag/res.h | 2 ++
diff --cc ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch
index a1dda1fcd11,a1dda1fcd11..f36a2d75818
--- a/ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch
+++ b/ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 29 Nov 2023 21:29:31 +0100
--Subject: [PATCH 05/10] Shrink size of static binary search tree
++Subject: [PATCH 05/11] Shrink size of static binary search tree
This also makes it more efficient on the data cache.
---
diff --cc ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch
index 57f1e0e92fc,57f1e0e92fc..7c6e1beebf4
--- a/ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch
+++ b/ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sun, 7 Jan 2024 21:59:28 +0100
--Subject: [PATCH 06/10] Patch out unused CSS style code
++Subject: [PATCH 06/11] Patch out unused CSS style code
---
source/lexbor/css/rule.h | 2 ++
diff --cc ext/lexbor/patches/0007-Add-lxb_url_is_special-to-the-public-API-362.patch
index ced72cbba90,00000000000..50bdc2397ba
mode 100644,000000..100644
--- a/ext/lexbor/patches/0007-Add-lxb_url_is_special-to-the-public-API-362.patch
+++ b/ext/lexbor/patches/0007-Add-lxb_url_is_special-to-the-public-API-362.patch
@@@ -1,44 -1,0 +1,44 @@@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
+Date: Sun, 17 May 2026 22:17:14 +0200
- Subject: [PATCH 07/10] Add lxb_url_is_special() to the public API (#362)
++Subject: [PATCH 07/11] Add lxb_url_is_special() to the public API (#362)
+
+As https://wiki.php.net/rfc/uri_followup#uri_type_detection relies on this information.
+---
+ source/lexbor/url/url.c | 2 +-
+ source/lexbor/url/url.h | 9 +++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/source/lexbor/url/url.c b/source/lexbor/url/url.c
+index 5a11434..a5b323f 100644
+--- a/source/lexbor/url/url.c
++++ b/source/lexbor/url/url.c
+@@ -860,7 +860,7 @@ lxb_url_is_url_codepoint(lxb_codepoint_t cp)
+ return lxb_url_codepoint_alphanumeric[(lxb_char_t) cp] != 0xFF;
+ }
+
+-lxb_inline bool
++bool
+ lxb_url_is_special(const lxb_url_t *url)
+ {
+ return url->scheme.type != LXB_URL_SCHEMEL_TYPE__UNKNOWN;
+diff --git a/source/lexbor/url/url.h b/source/lexbor/url/url.h
+index 4ed3f32..6cc6f10 100644
+--- a/source/lexbor/url/url.h
++++ b/source/lexbor/url/url.h
+@@ -763,6 +763,15 @@ LXB_API lxb_status_t
+ lxb_url_search_params_serialize(lxb_url_search_params_t *search_params,
+ lexbor_callback_f cb, void *ctx);
+
++/**
++ * Returns whether the URL is special.
++ *
++ * @param[in] lxb_url_t *. Cannot be NULL.
++ * @return true if URL is special, false otherwise.
++ */
++LXB_API bool
++lxb_url_is_special(const lxb_url_t *url);
++
+ /*
+ * Inline functions.
+ */
diff --cc ext/lexbor/patches/0008-URL-fixed-setters-for-empty-hosts.patch
index 233b42713c2,b55f5aac589..4218461c3ba
--- a/ext/lexbor/patches/0008-URL-fixed-setters-for-empty-hosts.patch
+++ b/ext/lexbor/patches/0008-URL-fixed-setters-for-empty-hosts.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Alexander Borisov <lex.borisov@gmail.com>
Date: Fri, 26 Jun 2026 18:55:56 +0300
- Subject: [PATCH 08/10] URL: fixed setters for empty hosts.
-Subject: [PATCH 07/10] URL: fixed setters for empty hosts.
++Subject: [PATCH 08/11] URL: fixed setters for empty hosts.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
diff --cc ext/lexbor/patches/0009-URL-fixed-uninitialized-memory-in-the-path-buffer-gr.patch
index 0b5ab2bce77,d967c8ca4eb..91e78a899f4
--- a/ext/lexbor/patches/0009-URL-fixed-uninitialized-memory-in-the-path-buffer-gr.patch
+++ b/ext/lexbor/patches/0009-URL-fixed-uninitialized-memory-in-the-path-buffer-gr.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Alexander Borisov <lex.borisov@gmail.com>
Date: Fri, 5 Jun 2026 22:13:32 +0300
- Subject: [PATCH 09/10] URL: fixed uninitialized memory in the path buffer
-Subject: [PATCH 08/10] URL: fixed uninitialized memory in the path buffer
++Subject: [PATCH 09/11] URL: fixed uninitialized memory in the path buffer
growth.
When a path was long enough to outgrow the on-stack buffer, the first
diff --cc ext/lexbor/patches/0010-Fix-parsing-for-URL-containing-empty-host-and-userin.patch
index e0b45ab4973,1e7aa4d1087..9cbf3e0094e
--- a/ext/lexbor/patches/0010-Fix-parsing-for-URL-containing-empty-host-and-userin.patch
+++ b/ext/lexbor/patches/0010-Fix-parsing-for-URL-containing-empty-host-and-userin.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
Date: Thu, 9 Jul 2026 21:51:05 +0200
- Subject: [PATCH 10/10] Fix parsing for URL containing empty host and userinfo
-Subject: [PATCH 09/10] Fix parsing for URL containing empty host and userinfo
++Subject: [PATCH 10/11] Fix parsing for URL containing empty host and userinfo
The returned error code (LXB_URL_ERROR_TYPE_INVALID_CREDENTIALS) apparently contradicts the specification:
diff --cc ext/lexbor/patches/0011-Percent-encode-the-caret-in-the-path.patch
index 00000000000,04d91bda68a..2781fad5bcb
mode 000000,100644..100644
--- a/ext/lexbor/patches/0011-Percent-encode-the-caret-in-the-path.patch
+++ b/ext/lexbor/patches/0011-Percent-encode-the-caret-in-the-path.patch
@@@ -1,0 -1,29 +1,29 @@@
+ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+ From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
+ Date: Fri, 10 Jul 2026 22:31:16 +0200
-Subject: [PATCH 10/10] Percent-encode the caret in the path
++Subject: [PATCH 11/11] Percent-encode the caret in the path
+
+ The caret (^) is part of the path percent-encode set:
+
+ "The path percent-encode set is a percent-encode set consisting of the query percent-encode set and U+003F (?), U+005E (^), U+0060 (`), U+007B ({), and U+007D (})."
+
+ Until now, this character wasn't percent-encoded in the path likely due to a copy-paste error. This is mistake is fixed by adding LXB_URL_MAP_PATH to the lxb_url_map entry for the caret.
+
+ Originally reported at https://github.com/php/php-src/issues/22628
+ ---
+ source/lexbor/url/url.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+ diff --git a/source/lexbor/url/url.c b/source/lexbor/url/url.c
-index 19ec238..de19239 100644
++index aed468a..8099c12 100644
+ --- a/source/lexbor/url/url.c
+ +++ b/source/lexbor/url/url.c
+ @@ -159,7 +159,7 @@ static const uint8_t lxb_url_map[256] =
+ LXB_URL_MAP_USERINFO|LXB_URL_MAP_COMPONENT|LXB_URL_MAP_X_WWW_FORM, /* 0x5b ([) */
+ LXB_URL_MAP_USERINFO|LXB_URL_MAP_COMPONENT|LXB_URL_MAP_X_WWW_FORM, /* 0x5c (\) */
+ LXB_URL_MAP_USERINFO|LXB_URL_MAP_COMPONENT|LXB_URL_MAP_X_WWW_FORM, /* 0x5d (]) */
+ - LXB_URL_MAP_USERINFO|LXB_URL_MAP_COMPONENT|LXB_URL_MAP_X_WWW_FORM, /* 0x5e (^) */
+ + LXB_URL_MAP_USERINFO|LXB_URL_MAP_PATH|LXB_URL_MAP_COMPONENT|LXB_URL_MAP_X_WWW_FORM, /* 0x5e (^) */
+ LXB_URL_MAP_UNDEF, /* 0x5f (_) */
+ LXB_URL_MAP_PATH|LXB_URL_MAP_FRAGMENT|LXB_URL_MAP_USERINFO|LXB_URL_MAP_COMPONENT|LXB_URL_MAP_X_WWW_FORM, /* 0x60 (`) */
+ LXB_URL_MAP_UNDEF, /* 0x61 (a) */