Skip to content

Conversation

@zonuexe
Copy link
Contributor

@zonuexe zonuexe commented Jan 25, 2023

I've seen #45769 merged and realize that these methods are probably accept unintended newlines.

The manual (PHP: Meta-characters) says that $ matches not only the end of the string, but also the terminating newline.
The \A and \z pairs are safe because they always match leading and trailing ends regardless of mode.

PHP: Escape sequences - Manual

The \A, \Z, and \z assertions differ from the traditional circumflex and dollar (described in anchors ) in that they only ever match at the very start and end of the subject string, whatever options are set. They are not affected by the PCRE_MULTILINE or PCRE_DOLLAR_ENDONLY options. The difference between \Z and \z is that \Z matches before a newline that is the last character of the string as well as at the end of the string, whereas \z matches only at the end.


I'm not a Laravel user, so I'm not too concerned with this issue. If more work is needed for compatibility, please close this PR and have someone else work on it again. thank you!

@taylorotwell taylorotwell merged commit 1a42e08 into laravel:9.x Jan 25, 2023
@zonuexe zonuexe deleted the fix/validationvalidator-do-not-accept-last-newline branch January 26, 2023 04:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants