创建 Bug 重现器

1
2
3
4
5
6
7
8
9
10
11
12
13

// First, run "composer require symfony/validator"
// Then, execute this file:
<?php
require_once __DIR__.'/vendor/autoload.php';
use Symfony\Component\Validator\Constraints;

$wrongUrl = 'http://example.com/exploit.html?<script>alert(1);</script>';
$urlValidator = new Constraints\UrlValidator();
$urlConstraint = new Constraints\Url();

// The URL is wrong, so var_dump() should display an error, but it displays
// "null" instead because there is no context to build a validator violation
var_dump($urlValidator->validate($wrongUrl, $urlConstraint));