diff --git a/lib/SimpleSAML/Utils/HTTP.php b/lib/SimpleSAML/Utils/HTTP.php index 75082498450486ca503e9219e0b093a4bbe80441..96cfc62ecc5146a83a5bafdeb4fdc877272e65dd 100644 --- a/lib/SimpleSAML/Utils/HTTP.php +++ b/lib/SimpleSAML/Utils/HTTP.php @@ -338,14 +338,15 @@ class HTTP // validates the URL's host is among those allowed if (is_array($trustedSites)) { assert(is_array($trustedSites)); - preg_match('@^http(s?)://([^/:]+)((?::\d+)?)@i', $url, $matches); - $hostname = $matches[2]; + $components = parse_url($url); + $hostname = $components['host']; // allow URLs with standard ports specified (non-standard ports must then be allowed explicitly) - if (!empty($matches[3]) && - (($matches[1] === '' && $matches[3] !== ':80') || ($matches[1]) === 's' && $matches[3] !== ':443') + if (isset($components['port']) && + (($components['scheme'] === 'http' && $components['port'] !== 80) || + ($components['scheme'] === 'https' && $components['port'] !== 443)) ) { - $hostname = $hostname.$matches[3]; + $hostname = $hostname.':'.$components['port']; } $self_host = self::getSelfHostWithNonStandardPort();