Pull Request resolves #

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

When Uri::getInstance() builds the current request URI from the server variables it already neutralises the characters ', ", < and > with a comment describing this as protection against injections through the Host header. Control characters, however, are passed through untouched. A hostile or misbehaving upstream layer can place raw CR, LF or NUL bytes into HTTP_HOST or REQUEST_URI, and those bytes then travel into every URL the CMS derives from the request URI, including links rendered into pages and values used by the routing.

Control characters are never valid inside a URL, so there is no legitimate input that this change could alter. The PR extends the existing cleanup step with a removal of the C0 control range and DEL, applied to the whole assembled URI before it is parsed:

$theURI = str_replace(["'", '"', '<', '>'], ['%27', '%22', '%3C', '%3E'], $theURI);
$theURI = (string) preg_replace('/[\x00-\x1F\x7F]/', '', $theURI);

A unit test builds the server URI with a CRLF suffix on the host and a NUL byte inside the request path and asserts the resulting URI no longer contains them. The test fails against the previous code.

Testing Instructions

Run the Uri unit tests:

libraries/vendor/bin/phpunit tests/Unit/Libraries/Cms/Uri/UriTest.php

The full unit suite passes with the change applied as well.

Actual result BEFORE applying this Pull Request

http://www.example.com\r\n/joomla/index.php\0?var=value 10 is what reaches the parser; control characters from the server variables survive inside the Uri instance and everything derived from it.

Expected result AFTER applying this Pull Request

The parsed URI is http://www.example.com/joomla/index.php?var=value 10; no control characters remain anywhere in the instance.

Link to documentations

• No documentation changes for guide.joomla.org needed
• No documentation changes for manual.joomla.org needed