From 560dfb2bb81721120dab15f6f233701aaa27b489 Mon Sep 17 00:00:00 2001 From: albertlast Date: Wed, 29 Jul 2026 21:08:13 +0200 Subject: [PATCH 1/2] Compares URL schemes case insensitively RFC 3986, section 3.1, makes scheme names case insensitive, and this class keeps the scheme exactly as it was written rather than normalizing it. isScheme() compared the two with in_array(), so a URL written with an uppercase scheme did not match its own name. That reaches two callers. isWebsite() stops recognising HTTP:// and HTTPS:// as websites, and the avatar handling in User treats a DATA: URI as though it were a remote address. Folds both sides before comparing, and makes the comparison strict while it is there. Co-Authored-By: Claude Opus 5 --- Sources/Url.php | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/Sources/Url.php b/Sources/Url.php index ae3421dfe36..b98c3c1f599 100644 --- a/Sources/Url.php +++ b/Sources/Url.php @@ -600,12 +600,23 @@ public function isWebsite(): bool /** * Check if this URL uses one of the specified schemes. * + * Scheme names are case insensitive, per RFC 3986, section 3.1, and this + * class does not normalize them, so both sides are folded before comparing. + * * @param string|string[] $scheme Schemes to check. * @return bool Whether the URL matches a scheme. */ public function isScheme(string|array $scheme): bool { - return !empty($this->scheme) && \in_array($this->scheme, array_map('strval', (array) $scheme)); + if (empty($this->scheme)) { + return false; + } + + return \in_array( + strtolower($this->scheme), + array_map(fn($s) => strtolower((string) $s), (array) $scheme), + true, + ); } /** From ffa035c57ad7f1d7e675d48cb85512f198733bbf Mon Sep 17 00:00:00 2001 From: Jon Stovell Date: Thu, 13 Aug 2026 20:26:49 -0600 Subject: [PATCH 2/2] Removes unnecessary comment --- Sources/Url.php | 3 --- 1 file changed, 3 deletions(-) diff --git a/Sources/Url.php b/Sources/Url.php index b98c3c1f599..11477ecadd7 100644 --- a/Sources/Url.php +++ b/Sources/Url.php @@ -600,9 +600,6 @@ public function isWebsite(): bool /** * Check if this URL uses one of the specified schemes. * - * Scheme names are case insensitive, per RFC 3986, section 3.1, and this - * class does not normalize them, so both sides are folded before comparing. - * * @param string|string[] $scheme Schemes to check. * @return bool Whether the URL matches a scheme. */