Merge R_2_5
[m6w6/ext-http] / php_http_url.c
index c4c0e15e72293067c1fb0b5433da817bcaf1e0ac..c5c19a55568bd6fd10ee8f310fb5a247d0e72030 100644 (file)
@@ -12,7 +12,9 @@
 
 #include "php_http_api.h"
 
-#ifdef PHP_HTTP_HAVE_IDN
+#if PHP_HTTP_HAVE_IDN2
+#      include <idn2.h>
+#elif PHP_HTTP_HAVE_IDN
 #      include <idna.h>
 #endif
 
@@ -57,7 +59,7 @@ static inline char *localhostname(void)
        return estrndup("localhost", lenof("localhost"));
 }
 
-#define url(buf) ((php_http_url_t *) buf.data)
+#define url(buf) ((php_http_url_t *) (buf).data)
 
 static php_http_url_t *php_http_url_from_env(void)
 {
@@ -125,13 +127,30 @@ static php_http_url_t *php_http_url_from_env(void)
 
 #define url_isset(u,n) \
        ((u)&&(u)->n)
+#define url_append(buf, append) do { \
+       char *_ptr = (buf)->data; \
+       php_http_url_t *_url = (php_http_url_t *) _ptr, _mem = *_url; \
+       append; \
+       /* relocate */ \
+       if (_ptr != (buf)->data) { \
+               ptrdiff_t diff = (buf)->data - _ptr; \
+               _url = (php_http_url_t *) (buf)->data; \
+               if (_mem.scheme)        _url->scheme += diff; \
+               if (_mem.user)          _url->user += diff; \
+               if (_mem.pass)          _url->pass += diff; \
+               if (_mem.host)          _url->host += diff; \
+               if (_mem.path)          _url->path += diff; \
+               if (_mem.query)         _url->query += diff; \
+               if (_mem.fragment)      _url->fragment += diff; \
+       } \
+} while (0)
 #define url_copy(n) do { \
        if (url_isset(new_url, n)) { \
                url(buf)->n = &buf.data[buf.used]; \
-               php_http_buffer_append(&buf, new_url->n, strlen(new_url->n) + 1); \
+               url_append(&buf, php_http_buffer_append(&buf, new_url->n, strlen(new_url->n) + 1)); \
        } else if (url_isset(old_url, n)) { \
                url(buf)->n = &buf.data[buf.used]; \
-               php_http_buffer_append(&buf, old_url->n, strlen(old_url->n) + 1); \
+               url_append(&buf, php_http_buffer_append(&buf, old_url->n, strlen(old_url->n) + 1)); \
        } \
 } while (0)
 
@@ -182,9 +201,9 @@ php_http_url_t *php_http_url_mod(const php_http_url_t *old_url, const php_http_u
                        
                        url(buf)->path = &buf.data[buf.used];
                        if (path[0] != '/') {
-                               php_http_buffer_append(&buf, "/", 1);
+                               url_append(&buf, php_http_buffer_append(&buf, "/", 1));
                        }
-                       php_http_buffer_append(&buf, path, strlen(path) + 1);
+                       url_append(&buf, php_http_buffer_append(&buf, path, strlen(path) + 1));
                        efree(path);
                } else {
                        const char *path = NULL;
@@ -198,7 +217,7 @@ php_http_url_t *php_http_url_mod(const php_http_url_t *old_url, const php_http_u
                        if (path) {
                                url(buf)->path = &buf.data[buf.used];
 
-                               php_http_buffer_append(&buf, path, strlen(path) + 1);
+                               url_append(&buf, php_http_buffer_append(&buf, path, strlen(path) + 1));
                        }
 
 
@@ -222,7 +241,7 @@ php_http_url_t *php_http_url_mod(const php_http_url_t *old_url, const php_http_u
                        php_http_querystring_update(&qarr, NULL, &qstr);
 
                        url(buf)->query = &buf.data[buf.used];
-                       php_http_buffer_append(&buf, Z_STRVAL(qstr), Z_STRLEN(qstr) + 1);
+                       url_append(&buf, php_http_buffer_append(&buf, Z_STRVAL(qstr), Z_STRLEN(qstr) + 1));
 
                        zval_dtor(&qstr);
                        zval_dtor(&qarr);
@@ -294,8 +313,8 @@ php_http_url_t *php_http_url_mod(const php_http_url_t *old_url, const php_http_u
        }
        /* unset default ports */
        if (url(buf)->port) {
-               if (    ((url(buf)->port == 80) && !strcmp(url(buf)->scheme, "http"))
-                       ||      ((url(buf)->port ==443) && !strcmp(url(buf)->scheme, "https"))
+               if (    ((url(buf)->port == 80) && url(buf)->scheme && !strcmp(url(buf)->scheme, "http"))
+                       ||      ((url(buf)->port ==443) && url(buf)->scheme && !strcmp(url(buf)->scheme, "https"))
                ) {
                        url(buf)->port = 0;
                }
@@ -367,6 +386,42 @@ char *php_http_url_to_string(const php_http_url_t *url, char **url_str, size_t *
        return buf.data;
 }
 
+char *php_http_url_authority_to_string(const php_http_url_t *url, char **url_str, size_t *url_len)
+{
+       php_http_buffer_t buf;
+
+       php_http_buffer_init(&buf);
+
+       if (url->user && *url->user) {
+               php_http_buffer_appendl(&buf, url->user);
+               if (url->pass && *url->pass) {
+                       php_http_buffer_appends(&buf, ":");
+                       php_http_buffer_appendl(&buf, url->pass);
+               }
+               php_http_buffer_appends(&buf, "@");
+       }
+
+       if (url->host && *url->host) {
+               php_http_buffer_appendl(&buf, url->host);
+               if (url->port) {
+                       php_http_buffer_appendf(&buf, ":%hu", url->port);
+               }
+       }
+
+       php_http_buffer_shrink(&buf);
+       php_http_buffer_fix(&buf);
+
+       if (url_len) {
+               *url_len = buf.used;
+       }
+
+       if (url_str) {
+               *url_str = buf.data;
+       }
+
+       return buf.data;
+}
+
 php_http_url_t *php_http_url_from_zval(zval *value, unsigned flags)
 {
        zend_string *zs;
@@ -399,25 +454,25 @@ php_http_url_t *php_http_url_from_struct(HashTable *ht)
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("scheme")))) {
                zend_string *zs = zval_get_string(e);
                url(buf)->scheme = &buf.data[buf.used];
-               php_http_buffer_append(&buf, zs->val, zs->len + 1);
+               url_append(&buf, php_http_buffer_append(&buf, zs->val, zs->len + 1));
                zend_string_release(zs);
        }
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("user")))) {
                zend_string *zs = zval_get_string(e);
                url(buf)->user = &buf.data[buf.used];
-               php_http_buffer_append(&buf, zs->val, zs->len + 1);
+               url_append(&buf, php_http_buffer_append(&buf, zs->val, zs->len + 1));
                zend_string_release(zs);
        }
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("pass")))) {
                zend_string *zs = zval_get_string(e);
                url(buf)->pass = &buf.data[buf.used];
-               php_http_buffer_append(&buf, zs->val, zs->len + 1);
+               url_append(&buf, php_http_buffer_append(&buf, zs->val, zs->len + 1));
                zend_string_release(zs);
        }
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("host")))) {
                zend_string *zs = zval_get_string(e);
                url(buf)->host = &buf.data[buf.used];
-               php_http_buffer_append(&buf, zs->val, zs->len + 1);
+               url_append(&buf, php_http_buffer_append(&buf, zs->val, zs->len + 1));
                zend_string_release(zs);
        }
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("port")))) {
@@ -426,19 +481,19 @@ php_http_url_t *php_http_url_from_struct(HashTable *ht)
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("path")))) {
                zend_string *zs = zval_get_string(e);
                url(buf)->path = &buf.data[buf.used];
-               php_http_buffer_append(&buf, zs->val, zs->len + 1);
+               url_append(&buf, php_http_buffer_append(&buf, zs->val, zs->len + 1));
                zend_string_release(zs);
        }
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("query")))) {
                zend_string *zs = zval_get_string(e);
                url(buf)->query = &buf.data[buf.used];
-               php_http_buffer_append(&buf, zs->val, zs->len + 1);
+               url_append(&buf, php_http_buffer_append(&buf, zs->val, zs->len + 1));
                zend_string_release(zs);
        }
        if ((e = zend_hash_str_find_ind(ht, ZEND_STRL("fragment")))) {
                zend_string *zs = zval_get_string(e);
                url(buf)->fragment = &buf.data[buf.used];
-               php_http_buffer_append(&buf, zs->val, zs->len + 1);
+               url_append(&buf, php_http_buffer_append(&buf, zs->val, zs->len + 1));
                zend_string_release(zs);
        }
 
@@ -514,8 +569,8 @@ HashTable *php_http_url_to_struct(const php_http_url_t *url, zval *strct)
 
 ZEND_RESULT_CODE php_http_url_encode_hash(HashTable *hash, const char *pre_encoded_str, size_t pre_encoded_len, char **encoded_str, size_t *encoded_len)
 {
-       const char *arg_sep_str;
-       size_t arg_sep_len;
+       const char *arg_sep_str = "&";
+       size_t arg_sep_len = 1;
        php_http_buffer_t *qstr = php_http_buffer_new();
 
        php_http_url_argsep(&arg_sep_str, &arg_sep_len);
@@ -620,8 +675,9 @@ static size_t parse_mb_loc(unsigned *wc, const char *ptr, const char *end)
        wchar_t wchar;
        size_t consumed = 0;
 #if defined(HAVE_MBRTOWC)
-       mbstate_t ps = {0};
+       mbstate_t ps;
 
+       memset(&ps, 0, sizeof(ps));
        consumed = mbrtowc(&wchar, ptr, end - ptr, &ps);
 #elif defined(HAVE_MBTOWC)
        consumed = mbtowc(&wchar, ptr, end - ptr);
@@ -703,9 +759,15 @@ static size_t parse_mb(struct parse_state *state, parse_mb_what_t what, const ch
        }
 
        if (!silent) {
-               php_error_docref(NULL, E_WARNING,
-                               "Failed to parse %s; unexpected byte 0x%02x at pos %u in '%s'",
-                               parse_what[what], (unsigned char) *ptr, (unsigned) (ptr - begin), begin);
+               if (consumed) {
+                       php_error_docref(NULL, E_WARNING,
+                                       "Failed to parse %s; unexpected multibyte sequence 0x%x at pos %u in '%s'",
+                                       parse_what[what], wchar, (unsigned) (ptr - begin), begin);
+               } else {
+                       php_error_docref(NULL, E_WARNING,
+                                       "Failed to parse %s; unexpected byte 0x%02x at pos %u in '%s'",
+                                       parse_what[what], (unsigned char) *ptr, (unsigned) (ptr - begin), begin);
+               }
        }
 
        return 0;
@@ -775,45 +837,244 @@ static ZEND_RESULT_CODE parse_userinfo(struct parse_state *state, const char *pt
        return SUCCESS;
 }
 
-static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *ptr)
+#if defined(PHP_WIN32) || defined(HAVE_UIDNA_IDNTOASCII)
+typedef size_t (*parse_mb_func)(unsigned *wc, const char *ptr, const char *end);
+static ZEND_RESULT_CODE to_utf16(parse_mb_func fn, const char *u8, uint16_t **u16, size_t *len)
 {
-       size_t mb, len;
-       const char *end = state->ptr, *tmp = ptr, *port = NULL;
+       size_t offset = 0, u8_len = strlen(u8);
 
+       *u16 = ecalloc(4 * sizeof(uint16_t), u8_len + 1);
+       *len = 0;
 
-#ifdef HAVE_INET_PTON
-       if (*ptr == '[') {
-               char *error = NULL, *tmp = memchr(ptr, ']', end - ptr);
-
-               if (tmp) {
-                       size_t addrlen = tmp - ptr + 1;
-                       char buf[16], *addr = estrndup(ptr + 1, addrlen - 2);
-                       int rv = inet_pton(AF_INET6, addr, buf);
-
-                       efree(addr);
-                       if (rv == 1) {
-                               state->buffer[state->offset] = '[';
-                               state->url.host = &state->buffer[state->offset];
-                               inet_ntop(AF_INET6, buf, state->url.host + 1, state->maxlen - state->offset);
-                               state->offset += strlen(state->url.host);
-                               state->buffer[state->offset++] = ']';
-                               state->buffer[state->offset++] = 0;
-                               ptr = tmp + 1;
-                       } else if (rv == -1) {
-                               error = strerror(errno);
-                       } else {
-                               error = "unexpected '['";
-                       }
+       while (offset < u8_len) {
+               unsigned wc;
+               uint16_t buf[2], *ptr = buf;
+               size_t consumed = fn(&wc, &u8[offset], &u8[u8_len]);
+
+               if (!consumed) {
+                       efree(*u16);
+                       php_error_docref(NULL, E_WARNING, "Failed to parse UTF-8 at pos %zu of '%s'", offset, u8);
+                       return FAILURE;
                } else {
-                       error = "expected ']'";
+                       offset += consumed;
                }
 
-               if (error) {
-                       php_error_docref(NULL, E_WARNING, "Failed to parse hostinfo; %s", error);
+               switch (wctoutf16(buf, wc)) {
+               case 2:
+                       (*u16)[(*len)++] = *ptr++;
+                       /* no break */
+               case 1:
+                       (*u16)[(*len)++] = *ptr++;
+                       break;
+               case 0:
+               default:
+                       efree(*u16);
+                       php_error_docref(NULL, E_WARNING, "Failed to convert UTF-32 'U+%X' to UTF-16", wc);
                        return FAILURE;
                }
        }
+
+       return SUCCESS;
+}
 #endif
+
+#ifndef MAXHOSTNAMELEN
+#      define MAXHOSTNAMELEN 256
+#endif
+
+#if PHP_HTTP_HAVE_IDN2
+static ZEND_RESULT_CODE parse_idn2(struct parse_state *state, size_t prev_len)
+{
+       char *idn = NULL;
+       int rv = -1;
+
+       if (state->flags & PHP_HTTP_URL_PARSE_MBUTF8) {
+               rv = idn2_lookup_u8((const unsigned char *) state->url.host, (unsigned char **) &idn, IDN2_NFC_INPUT);
+       }
+#      ifdef PHP_HTTP_HAVE_WCHAR
+       else if (state->flags & PHP_HTTP_URL_PARSE_MBLOC) {
+               rv = idn2_lookup_ul(state->url.host, &idn, 0);
+       }
+#      endif
+       if (rv != IDN2_OK) {
+               php_error_docref(NULL, E_WARNING, "Failed to parse IDN; %s", idn2_strerror(rv));
+               return FAILURE;
+       } else {
+               size_t idnlen = strlen(idn);
+               memcpy(state->url.host, idn, idnlen + 1);
+               free(idn);
+               state->offset += idnlen - prev_len;
+               return SUCCESS;
+       }
+}
+#elif PHP_HTTP_HAVE_IDN
+static ZEND_RESULT_CODE parse_idn(struct parse_state *state, size_t prev_len)
+{
+       char *idn = NULL;
+       int rv = -1;
+
+       if (state->flags & PHP_HTTP_URL_PARSE_MBUTF8) {
+               rv = idna_to_ascii_8z(state->url.host, &idn, IDNA_ALLOW_UNASSIGNED|IDNA_USE_STD3_ASCII_RULES);
+       }
+#      ifdef PHP_HTTP_HAVE_WCHAR
+       else if (state->flags & PHP_HTTP_URL_PARSE_MBLOC) {
+               rv = idna_to_ascii_lz(state->url.host, &idn, IDNA_ALLOW_UNASSIGNED|IDNA_USE_STD3_ASCII_RULES);
+       }
+#      endif
+       if (rv != IDNA_SUCCESS) {
+               php_error_docref(NULL, E_WARNING, "Failed to parse IDN; %s", idna_strerror(rv));
+               return FAILURE;
+       } else {
+               size_t idnlen = strlen(idn);
+               memcpy(state->url.host, idn, idnlen + 1);
+               free(idn);
+               state->offset += idnlen - prev_len;
+               return SUCCESS;
+       }
+}
+#endif
+
+#ifdef HAVE_UIDNA_IDNTOASCII
+#      if HAVE_UNICODE_UIDNA_H
+#              include <unicode/uidna.h>
+#      else
+typedef uint16_t UChar;
+typedef enum { U_ZERO_ERROR = 0 } UErrorCode;
+int32_t uidna_IDNToASCII(const UChar *src, int32_t srcLength, UChar *dest, int32_t destCapacity, int32_t options, void *parseError, UErrorCode *status);
+#      endif
+static ZEND_RESULT_CODE parse_uidn(struct parse_state *state)
+{
+       char *host_ptr;
+       uint16_t *uhost_str, ahost_str[MAXHOSTNAMELEN], *ahost_ptr;
+       size_t uhost_len, ahost_len;
+       UErrorCode error = U_ZERO_ERROR;
+
+       if (state->flags & PHP_HTTP_URL_PARSE_MBUTF8) {
+               if (SUCCESS != to_utf16(parse_mb_utf8, state->url.host, &uhost_str, &uhost_len)) {
+                       return FAILURE;
+               }
+#ifdef PHP_HTTP_HAVE_WCHAR
+       } else if (state->flags & PHP_HTTP_URL_PARSE_MBLOC) {
+               if (SUCCESS != to_utf16(parse_mb_loc, state->url.host, &uhost_str, &uhost_len)) {
+                       return FAILURE;
+               }
+#endif
+       } else {
+               php_error_docref(NULL, E_WARNING, "Failed to parse IDN; codepage not specified");
+               return FAILURE;
+       }
+
+       ahost_len = uidna_IDNToASCII(uhost_str, uhost_len, ahost_str, MAXHOSTNAMELEN, 3, NULL, &error);
+       efree(uhost_str);
+
+       if (error != U_ZERO_ERROR) {
+               php_error_docref(NULL, E_WARNING, "Failed to parse IDN; ICU error %d", error);
+               return FAILURE;
+       }
+
+       host_ptr = state->url.host;
+       ahost_ptr = ahost_str;
+       PHP_HTTP_DUFF(ahost_len, *host_ptr++ = *ahost_ptr++);
+
+       *host_ptr = '\0';
+       state->offset += host_ptr - state->url.host;
+
+       return SUCCESS;
+}
+#endif
+
+#if 0 && defined(PHP_WIN32)
+static ZEND_RESULT_CODE parse_widn(struct parse_state *state)
+{
+       char *host_ptr;
+       uint16_t *uhost_str, ahost_str[MAXHOSTNAMELEN], *ahost_ptr;
+       size_t uhost_len;
+
+       if (state->flags & PHP_HTTP_URL_PARSE_MBUTF8) {
+               if (SUCCESS != to_utf16(parse_mb_utf8, state->url.host, &uhost_str, &uhost_len)) {
+                       php_error_docref(NULL, E_WARNING, "Failed to parse IDN");
+                       return FAILURE;
+               }
+#ifdef PHP_HTTP_HAVE_WCHAR
+       } else if (state->flags & PHP_HTTP_URL_PARSE_MBLOC) {
+               if (SUCCESS != to_utf16(parse_mb_loc, state->url.host, &uhost_str, &uhost_len)) {
+                       php_error_docref(NULL, E_WARNING, "Failed to parse IDN");
+                       return FAILURE;
+               }
+#endif
+       } else {
+               php_error_docref(NULL, E_WARNING, "Failed to parse IDN");
+               return FAILURE;
+       }
+
+       if (!IdnToAscii(IDN_ALLOW_UNASSIGNED|IDN_USE_STD3_ASCII_RULES, uhost_str, uhost_len, ahost_str, MAXHOSTNAMELEN)) {
+               efree(uhost_str);
+               php_error_docref(NULL, E_WARNING, "Failed to parse IDN");
+               return FAILURE;
+       }
+
+       efree(uhost_str);
+       host_ptr = state->url.host;
+       ahost_ptr = ahost_str;
+       PHP_HTTP_DUFF(wcslen(ahost_str), *host_ptr++ = *ahost_ptr++);
+       efree(ahost_str);
+
+       *host_ptr = '\0';
+       state->offset += host_ptr - state->url.host;
+
+       return SUCCESS;
+}
+#endif
+
+#ifdef HAVE_INET_PTON
+static const char *parse_ip6(struct parse_state *state, const char *ptr)
+{
+       size_t mb, len;
+       const char *error = NULL, *end = state->ptr, *tmp = memchr(ptr, ']', end - ptr);
+
+       if (tmp) {
+               size_t addrlen = tmp - ptr + 1;
+               char buf[16], *addr = estrndup(ptr + 1, addrlen - 2);
+               int rv = inet_pton(AF_INET6, addr, buf);
+
+               if (rv == 1) {
+                       state->buffer[state->offset] = '[';
+                       state->url.host = &state->buffer[state->offset];
+                       inet_ntop(AF_INET6, buf, state->url.host + 1, state->maxlen - state->offset);
+                       state->offset += strlen(state->url.host);
+                       state->buffer[state->offset++] = ']';
+                       state->buffer[state->offset++] = 0;
+                       ptr = tmp + 1;
+               } else if (rv == -1) {
+                       error = strerror(errno);
+               } else {
+                       error = "unexpected '['";
+               }
+               efree(addr);
+       } else {
+               error = "expected ']'";
+       }
+
+       if (error) {
+               php_error_docref(NULL, E_WARNING, "Failed to parse hostinfo; %s", error);
+               return NULL;
+       }
+
+       return ptr;
+}
+#endif
+
+static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *ptr)
+{
+       size_t mb, len;
+       const char *end = state->ptr, *tmp = ptr, *port = NULL, *label = NULL;
+
+#ifdef HAVE_INET_PTON
+       if (*ptr == '[' && !(ptr = parse_ip6(state, ptr))) {
+               return FAILURE;
+       }
+#endif
+
        if (ptr != end) do {
                switch (*ptr) {
                case ':':
@@ -841,6 +1102,20 @@ static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *pt
                case '!': case '$': case '&': case '\'': case '(': case ')': case '*':
                case '+': case ',': case ';': case '=': /* sub-delims */
                case '-': case '.': case '_': case '~': /* unreserved */
+                       if (port || !label) {
+                               /* sort of a compromise, just ensure we don't end up
+                                * with a dot at the beginning or two consecutive dots
+                                */
+                               php_error_docref(NULL, E_WARNING,
+                                               "Failed to parse %s; unexpected '%c' at pos %u in '%s'",
+                                               port ? "port" : "host",
+                                               (unsigned char) *ptr, (unsigned) (ptr - tmp), tmp);
+                               return FAILURE;
+                       }
+                       state->buffer[state->offset++] = *ptr;
+                       label = NULL;
+                       break;
+
                case 'A': case 'B': case 'C': case 'D': case 'E': case 'F': case 'G':
                case 'H': case 'I': case 'J': case 'K': case 'L': case 'M': case 'N':
                case 'O': case 'P': case 'Q': case 'R': case 'S': case 'T': case 'U':
@@ -863,12 +1138,15 @@ static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *pt
                                state->url.port *= 10;
                                state->url.port += *ptr - '0';
                        } else {
+                               label = ptr;
                                state->buffer[state->offset++] = *ptr;
                        }
                        break;
 
                default:
-                       if (port) {
+                       if (ptr == end) {
+                               break;
+                       } else if (port) {
                                php_error_docref(NULL, E_WARNING,
                                                "Failed to parse port; unexpected byte 0x%02x at pos %u in '%s'",
                                                (unsigned char) *ptr, (unsigned) (ptr - tmp), tmp);
@@ -876,6 +1154,7 @@ static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *pt
                        } else if (!(mb = parse_mb(state, PARSE_HOSTINFO, ptr, end, tmp, 0))) {
                                return FAILURE;
                        }
+                       label = ptr;
                        ptr += mb - 1;
                }
        } while (++ptr != end);
@@ -886,30 +1165,19 @@ static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *pt
                state->buffer[state->offset++] = 0;
        }
 
-#ifdef PHP_HTTP_HAVE_IDN
        if (state->flags & PHP_HTTP_URL_PARSE_TOIDN) {
-               char *idn = NULL;
-               int rv = -1;
-
-               if (state->flags & PHP_HTTP_URL_PARSE_MBUTF8) {
-                       rv = idna_to_ascii_8z(state->url.host, &idn, IDNA_ALLOW_UNASSIGNED|IDNA_USE_STD3_ASCII_RULES);
-               }
-#      ifdef PHP_HTTP_HAVE_WCHAR
-               else if (state->flags & PHP_HTTP_URL_PARSE_MBLOC) {
-                       rv = idna_to_ascii_lz(state->url.host, &idn, IDNA_ALLOW_UNASSIGNED|IDNA_USE_STD3_ASCII_RULES);
-               }
-#      endif
-               if (rv != IDNA_SUCCESS) {
-                       php_error_docref(NULL, E_WARNING, "Failed to parse IDN; %s", idna_strerror(rv));
-                       return FAILURE;
-               } else {
-                       size_t idnlen = strlen(idn);
-                       memcpy(state->url.host, idn, idnlen + 1);
-                       free(idn);
-                       state->offset += idnlen - len;
-               }
-       }
+#if PHP_HTTP_HAVE_IDN2
+               return parse_idn2(state, len);
+#elif PHP_HTTP_HAVE_IDN
+               return parse_idn(state, len);
+#endif
+#ifdef HAVE_UIDNA_IDNTOASCII
+               return parse_uidn(state);
+#endif
+#if 0 && defined(PHP_WIN32)
+               return parse_widn(state);
 #endif
+       }
 
        return SUCCESS;
 }
@@ -938,6 +1206,7 @@ static const char *parse_authority(struct parse_state *state)
                case '?':
                case '#':
                case '\0':
+                       EOD:
                        /* host delimiter */
                        if (tmp != state->ptr && SUCCESS != parse_hostinfo(state, tmp)) {
                                return NULL;
@@ -946,7 +1215,8 @@ static const char *parse_authority(struct parse_state *state)
                }
        } while (++state->ptr <= state->end);
 
-       return NULL;
+       --state->ptr;
+       goto EOD;
 }
 
 static const char *parse_path(struct parse_state *state)
@@ -1030,7 +1300,7 @@ static const char *parse_query(struct parse_state *state)
        tmp = ++state->ptr;
        state->url.query = &state->buffer[state->offset];
 
-       do {
+       while (state->ptr < state->end) {
                switch (*state->ptr) {
                case '#':
                        goto done;
@@ -1047,8 +1317,11 @@ static const char *parse_query(struct parse_state *state)
                        state->buffer[state->offset++] = *state->ptr;
                        break;
 
-               case ']':
-               case '[':
+               /* RFC1738 unsafe */
+               case '{': case '}':
+               case '<': case '>':
+               case '[': case ']':
+               case '|': case '\\': case '^': case '`': case '"': case ' ':
                        if (state->flags & PHP_HTTP_URL_PARSE_TOPCT) {
                                state->buffer[state->offset++] = '%';
                                state->buffer[state->offset++] = parse_xdigits[((unsigned char) *state->ptr) >> 4];
@@ -1082,7 +1355,9 @@ static const char *parse_query(struct parse_state *state)
                        }
                        state->ptr += mb - 1;
                }
-       } while (++state->ptr < state->end);
+
+               ++state->ptr;
+       }
 
        done:
        state->buffer[state->offset++] = 0;
@@ -1117,6 +1392,19 @@ static const char *parse_fragment(struct parse_state *state)
                        state->buffer[state->offset++] = *state->ptr;
                        break;
 
+               /* RFC1738 unsafe */
+               case '{': case '}':
+               case '<': case '>':
+               case '[': case ']':
+               case '|': case '\\': case '^': case '`': case '"': case ' ':
+                       if (state->flags & PHP_HTTP_URL_PARSE_TOPCT) {
+                               state->buffer[state->offset++] = '%';
+                               state->buffer[state->offset++] = parse_xdigits[((unsigned char) *state->ptr) >> 4];
+                               state->buffer[state->offset++] = parse_xdigits[((unsigned char) *state->ptr) & 0xf];
+                               break;
+                       }
+                       /* no break */
+
                case '?': case '/':
                case '!': case '$': case '&': case '\'': case '(': case ')': case '*':
                case '+': case ',': case ';': case '=': /* sub-delims */
@@ -1243,6 +1531,32 @@ php_http_url_t *php_http_url_parse(const char *str, size_t len, unsigned flags)
        return (php_http_url_t *) state;
 }
 
+php_http_url_t *php_http_url_parse_authority(const char *str, size_t len, unsigned flags)
+{
+       size_t maxlen = 3 * len;
+       struct parse_state *state = ecalloc(1, sizeof(*state) + maxlen);
+
+       state->end = str + len;
+       state->ptr = str;
+       state->flags = flags;
+       state->maxlen = maxlen;
+
+       if (!(state->ptr = parse_authority(state))) {
+               efree(state);
+               return NULL;
+       }
+
+       if (state->ptr != state->end) {
+               php_error_docref(NULL, E_WARNING,
+                               "Failed to parse URL authority, unexpected character at pos %u in '%s'",
+                               (unsigned) (state->ptr - str), str);
+               efree(state);
+               return NULL;
+       }
+
+       return (php_http_url_t *) state;
+}
+
 ZEND_BEGIN_ARG_INFO_EX(ai_HttpUrl___construct, 0, 0, 0)
        ZEND_ARG_INFO(0, old_url)
        ZEND_ARG_INFO(0, new_url)
@@ -1299,7 +1613,7 @@ ZEND_END_ARG_INFO();
 PHP_METHOD(HttpUrl, mod)
 {
        zval *new_url = NULL;
-       zend_long flags = PHP_HTTP_URL_JOIN_PATH | PHP_HTTP_URL_JOIN_QUERY;
+       zend_long flags = PHP_HTTP_URL_JOIN_PATH | PHP_HTTP_URL_JOIN_QUERY | PHP_HTTP_URL_SANITIZE_PATH;
        zend_error_handling zeh;
 
        php_http_expect(SUCCESS == zend_parse_parameters(ZEND_NUM_ARGS(), "z!|l", &new_url, &flags), invalid_arg, return);
@@ -1414,7 +1728,7 @@ PHP_MINIT_FUNCTION(http_url)
        zend_declare_class_constant_long(php_http_url_class_entry, ZEND_STRL("PARSE_MBLOC"), PHP_HTTP_URL_PARSE_MBLOC);
 #endif
        zend_declare_class_constant_long(php_http_url_class_entry, ZEND_STRL("PARSE_MBUTF8"), PHP_HTTP_URL_PARSE_MBUTF8);
-#ifdef PHP_HTTP_HAVE_IDN
+#if defined(PHP_HTTP_HAVE_IDN2) || defined(PHP_HTTP_HAVE_IDN) || defined(HAVE_UIDNA_IDNTOASCII)
        zend_declare_class_constant_long(php_http_url_class_entry, ZEND_STRL("PARSE_TOIDN"), PHP_HTTP_URL_PARSE_TOIDN);
 #endif
        zend_declare_class_constant_long(php_http_url_class_entry, ZEND_STRL("PARSE_TOPCT"), PHP_HTTP_URL_PARSE_TOPCT);