{"record":{"id":"1b93ed4a239c7587","repo":"symfony/http-foundation","slug":"invalid-uri","errorCode":null,"errorMessage":"Invalid URI.","messagePattern":"Invalid URI\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"Request.php","lineNumber":397,"sourceCode":"            'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',\n            'HTTP_ACCEPT_LANGUAGE' => 'en-us,en;q=0.5',\n            'HTTP_ACCEPT_CHARSET' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',\n            'REMOTE_ADDR' => '127.0.0.1',\n            'SCRIPT_NAME' => '',\n            'SCRIPT_FILENAME' => '',\n            'SERVER_PROTOCOL' => 'HTTP/1.1',\n            'REQUEST_TIME' => time(),\n            'REQUEST_TIME_FLOAT' => microtime(true),\n        ], $server);\n\n        $server['PATH_INFO'] = '';\n        $server['REQUEST_METHOD'] = strtoupper($method);\n\n        if (($i = strcspn($uri, ':/?#')) && ':' === ($uri[$i] ?? null) && (strspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-.') !== $i || strcspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'))) {\n            throw new BadRequestException('Invalid URI: Scheme is malformed.');\n        }\n        if (false === $components = parse_url(\\strlen($uri) !== strcspn($uri, '?#') ? $uri : $uri.'#')) {\n            throw new BadRequestException('Invalid URI.');\n        }\n\n        $part = ($components['user'] ?? '').':'.($components['pass'] ?? '');\n\n        if (':' !== $part && \\strlen($part) !== strcspn($part, '[]')) {\n            throw new BadRequestException('Invalid URI: Userinfo is malformed.');\n        }\n        if (($part = $components['host'] ?? '') && !self::isHostValid($part)) {\n            throw new BadRequestException('Invalid URI: Host is malformed.');\n        }\n        if (false !== ($i = strpos($uri, '\\\\')) && $i < strcspn($uri, '?#')) {\n            throw new BadRequestException('Invalid URI: A URI cannot contain a backslash.');\n        }\n        if (\\strlen($uri) !== strcspn($uri, \"\\r\\n\\t\")) {\n            throw new BadRequestException('Invalid URI: A URI cannot contain CR/LF/TAB characters.');\n        }\n        if ('' !== $uri && (\\ord($uri[0]) <= 32 || \\ord($uri[-1]) <= 32)) {\n            throw new BadRequestException('Invalid URI: A URI must not start nor end with ASCII control characters or spaces.');","sourceCodeStart":379,"sourceCodeEnd":415,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Request.php#L379-L415","documentation":"Request::create() runs parse_url() on the URI (with a '#' appended when no '?'/#' is present, to stabilize parsing). If parse_url returns false, the URI is fundamentally unparseable and Request::create() throws BadRequestException('Invalid URI.'). This follows the earlier, more specific scheme and userinfo checks.","triggerScenarios":"Request::create('http://'), 'http:///path', a URI with an unparseable structure (e.g. malformed brackets 'http://[::1', bare control characters), or empty/garbage strings that fail parse_url.","commonSituations":"User-supplied URLs passed straight into Request::create (e.g. building sub-requests for redirects); URLs truncated by logs or config; IPv6 literals with missing closing bracket; URLs containing spaces that were never urlencoded.","solutions":["Validate the URL with filter_var($uri, FILTER_VALIDATE_URL) before calling Request::create","Fix the URI: add the missing scheme/host, url-encode spaces, close IPv6 brackets","urlencode/rawurlencode dynamic path components before assembling the URI","Catch BadRequestException around Request::create and reject the input with a 400"],"exampleFix":"// before\n$request = Request::create('http://[::1:8080/path'); // parse_url fails -> throws\n// after\n$uri = 'http://[::1]:8080/path';\nif (!filter_var($uri, \\FILTER_VALIDATE_URL)) { throw new \\InvalidArgumentException('Bad url'); }\n$request = Request::create($uri);","handlingStrategy":"validation","validationCode":"if (false === filter_var($uri, \\FILTER_VALIDATE_URL) && !str_starts_with($uri, '/')) {\n    throw new \\InvalidArgumentException('Unparseable URL: '.$uri);\n}","typeGuard":"function isParseableUri(string $uri): bool {\n    return false !== parse_url($uri);\n}","tryCatchPattern":"try {\n    $request = Request::create($uri);\n} catch (BadRequestException $e) {\n    return new Response('Invalid URI', 400);\n}","preventionTips":["Validate URIs with filter_var(..., FILTER_VALIDATE_URL) before sub-request creation","Encode spaces and special characters (rawurlencode) in dynamic parts","Check IPv6 literals are fully bracketed, e.g. http://[::1]:8080/","Reject or trim empty/garbage input early at the boundary where the URL is collected"],"tags":["http","request","uri","parse-url"],"backgroundTag":"invalid-url","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}