{"record":{"id":"71525de687d23838","repo":"symfony/http-foundation","slug":"invalid-uri-scheme-is-malformed","errorCode":null,"errorMessage":"Invalid URI: Scheme is malformed.","messagePattern":"Invalid URI: Scheme is malformed\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"Request.php","lineNumber":394,"sourceCode":"            'SERVER_PORT' => 80,\n            'HTTP_HOST' => 'localhost',\n            'HTTP_USER_AGENT' => 'Symfony',\n            'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',\n            'HTTP_ACCEPT_LANGUAGE' => 'en-us,en;q=0.5',\n            'HTTP_ACCEPT_CHARSET' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',\n            'REMOTE_ADDR' => '127.0.0.1',\n            'SCRIPT_NAME' => '',\n            'SCRIPT_FILENAME' => '',\n            'SERVER_PROTOCOL' => 'HTTP/1.1',\n            'REQUEST_TIME' => time(),\n            'REQUEST_TIME_FLOAT' => microtime(true),\n        ], $server);\n\n        $server['PATH_INFO'] = '';\n        $server['REQUEST_METHOD'] = strtoupper($method);\n\n        if (($i = strcspn($uri, ':/?#')) && ':' === ($uri[$i] ?? null) && (strspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-.') !== $i || strcspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'))) {\n            throw new BadRequestException('Invalid URI: Scheme is malformed.');\n        }\n        if (false === $components = parse_url(\\strlen($uri) !== strcspn($uri, '?#') ? $uri : $uri.'#')) {\n            throw new BadRequestException('Invalid URI.');\n        }\n\n        $part = ($components['user'] ?? '').':'.($components['pass'] ?? '');\n\n        if (':' !== $part && \\strlen($part) !== strcspn($part, '[]')) {\n            throw new BadRequestException('Invalid URI: Userinfo is malformed.');\n        }\n        if (($part = $components['host'] ?? '') && !self::isHostValid($part)) {\n            throw new BadRequestException('Invalid URI: Host is malformed.');\n        }\n        if (false !== ($i = strpos($uri, '\\\\')) && $i < strcspn($uri, '?#')) {\n            throw new BadRequestException('Invalid URI: A URI cannot contain a backslash.');\n        }\n        if (\\strlen($uri) !== strcspn($uri, \"\\r\\n\\t\")) {\n            throw new BadRequestException('Invalid URI: A URI cannot contain CR/LF/TAB characters.');","sourceCodeStart":376,"sourceCodeEnd":412,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/Request.php#L376-L412","documentation":"Request::create() validates the scheme portion of the supplied URI before parsing. If the text before the first ':' looks like a scheme (a colon is present before any '/', '?', or '#') but contains characters outside the legal scheme alphabet (letters, digits, '+', '-', '.') — or contains no letters at all — it throws BadRequestException('Invalid URI: Scheme is malformed.').","triggerScenarios":"Request::create('ht tp://example.com'), '1http://example.com', '::example.com', or any URI whose prefix before ':' contains spaces, underscores, or starts with a non-letter while still having a ':' before the first /?#.","commonSituations":"Copied URLs with stray spaces or full-width characters; programmatically built URIs with unencoded characters; mistyped scheme like 'http_://'; user-supplied redirect targets passed to Request::create in tests or controllers.","solutions":["Fix the URI string: ensure a valid scheme (letter first, then letters/digits/+/-/.) followed by '://'","Trim and sanitize user-supplied URLs before passing to Request::create","If the input may be relative, only pass URIs without a bogus prefix, or prepend the intended scheme/host explicitly","Catch BadRequestException and return a 400 response for invalid user input"],"exampleFix":"// before\n$request = Request::create('ht tp://example.com/path'); // throws\n// after\n$request = Request::create('https://example.com/path');","handlingStrategy":"validation","validationCode":"if (preg_match('#^[A-Za-z][A-Za-z0-9+.\\-]*:#', $uri) && !preg_match('#^[A-Za-z][A-Za-z0-9+.\\-]*://#', $uri)) {\n    throw new \\InvalidArgumentException('Scheme is malformed');\n}","typeGuard":"function hasValidScheme(string $uri): bool {\n    $i = strcspn($uri, ':/?#');\n    return !($i && ':' === ($uri[$i] ?? null) && (strspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+-.') !== $i || strcspn($uri, 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ')));\n}","tryCatchPattern":"try {\n    $request = Request::create($uri);\n} catch (BadRequestException $e) {\n    return new Response('Invalid URL', 400);\n}","preventionTips":["Trim whitespace and normalize user-supplied URLs before Request::create","Ensure schemes look like 'scheme://', letters first","urlencode arbitrary path segments before composing URIs","Validate with filter_var($uri, FILTER_VALIDATE_URL) upstream"],"tags":["http","request","uri","validation"],"backgroundTag":"invalid-url-format","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}