GHSA-mrqx-rp3w-jpjp Symfony vulnerable to open redirect via browser-sanitized URLs

• Packagist symfony/http-foundation: < 5.4.46 → fixed in 5.4.46 • Packagist symfony/http-foundation: >= 6.0.0, < 6.4.14 → fixed in 6.4.14 • Packagist symfony/http-foundation: >= 7.0.0, < 7.1.7 → fixed in 7.1.7

Description The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. Resolution The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/ The patch for this issue is available here for branch 5.4. Credits We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.