Merge branch 'AC-8425' into cia-2.4.7-beta2-develop-bugfix-07112023

Author: pawan-adobe-security

lib/internal/Magento/Framework/Url/Test/Unit/ValidatorTest.php

@@ -23,6 +23,9 @@ class ValidatorTest extends TestCase
     /** @var string[] */
     protected $expectedValidationMessages = [Uri::INVALID => "Invalid URL '%value%'."];
 
+    /** @var string[] */
+    protected $invalidURL = [Uri::INVALID => "Invalid URL 'php://filter'."];
+
     protected function setUp(): void
     {
         $objectManager = new ObjectManager($this);
@@ -59,4 +62,13 @@ public function testIsValidWhenInvalid()
         $this->assertFalse($this->object->isValid('%value%'));
         $this->assertEquals($this->expectedValidationMessages, $this->object->getMessages());
     }
+
+    public function testIsValidWhenInvalidURL()
+    {
+        $this->laminasValidator
+            ->method('isValid')
+            ->with('php://filter');
+        $this->assertFalse($this->object->isValid('php://filter'));
+        $this->assertEquals($this->invalidURL, $this->object->getMessages());
+    }
 }

lib/internal/Magento/Framework/Url/Validator.php

@@ -55,11 +55,14 @@ public function isValid($value)
         $this->setValue($value);
 
         $valid = $this->validator->isValid($value);
-
-        if (!$valid) {
-            $this->error(Uri::INVALID);
+        // phpcs:ignore Magento2.Functions.DiscouragedFunction
+        $protocol = parse_url($value ? $value : '', PHP_URL_SCHEME);
+        if ($valid && ($protocol === 'https' || $protocol === 'http')) {
+            return true;
         }
 
-        return $valid;
+        $this->error(Uri::INVALID);
+
+        return false;
     }
 }