php · symfony/routingHeads-up
symfony/routing: UrlGenerator now encodes dot-segments to prevent path collapse
UrlGenerator::doGenerate() now uses preg_replace_callback to encode all consecutive dot-segments (e.
What changed
UrlGenerator::doGenerate() now uses preg_replace_callback to encode all consecutive dot-segments (e.g., /../, /./) in generated URLs, preventing RFC 3986 normalization from collapsing the path to a different route.
Who it affects
Applications using Symfony Routing with route parameters that accept dots and slashes (e.g., .+, .*), and using UrlGenerator, Twig path()/url(), or any server-side URL generation.
What to do today
Update symfony/routing to the patched version (5.4.x, 6.4.x, 7.4.x, 8.0.x, 8.1.x) as soon as possible.
The trail
Collected→
Audited→
Written→
Published