From 433f8d62bf3130797280b5d9fb3b54d584eba2ae Mon Sep 17 00:00:00 2001
From: Volker Dusch <volker@thephp.foundation>
Date: Wed, 10 Jun 2026 01:55:50 +0200
Subject: [PATCH] Reject trailing newline in alnum, url and e164

Add PCRE_DOLLAR_ENDONLY modifier to disallow strings with trailing newlines.

Asserts that wrap PHP functions like numeric("123\n") are untouched.
---
 lib/Assert/Assertion.php          | 6 +++---
 tests/Assert/Tests/AssertTest.php | 9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/Assert/Assertion.php b/lib/Assert/Assertion.php
index 81bc978..56962c0 100644
--- a/lib/Assert/Assertion.php
+++ b/lib/Assert/Assertion.php
@@ -1748,7 +1748,7 @@ public static function url($value, $message = null, ?string $propertyPath = null
             (?:/ (?:[\pL\pN\-._\~!$&\'()*+,;=:@]|%%[0-9A-Fa-f]{2})* )*          # a path
             (?:\? (?:[\pL\pN\-._\~!$&\'\[\]()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )?   # a query (optional)
             (?:\# (?:[\pL\pN\-._\~!$&\'()*+,;=:@/?]|%%[0-9A-Fa-f]{2})* )?       # a fragment (optional)
-        $~ixu';
+        $~ixuD';
 
         $pattern = \sprintf($pattern, \implode('|', $protocols));
 
@@ -1775,7 +1775,7 @@ public static function url($value, $message = null, ?string $propertyPath = null
     public static function alnum($value, $message = null, ?string $propertyPath = null): bool
     {
         try {
-            static::regex($value, '(^([a-zA-Z]{1}[a-zA-Z0-9]*)$)', $message, $propertyPath);
+            static::regex($value, '(^([a-zA-Z]{1}[a-zA-Z0-9]*)$)D', $message, $propertyPath);
         } catch (Throwable $e) {
             $message = \sprintf(
                 static::generateMessage($message ?: 'Value "%s" is not alphanumeric, starting with letters and containing only letters and numbers.'),
@@ -2004,7 +2004,7 @@ public static function uuid($value, $message = null, ?string $propertyPath = nul
      */
     public static function e164($value, $message = null, ?string $propertyPath = null): bool
     {
-        if (!\preg_match('/^\+?[1-9]\d{1,14}$/', $value)) {
+        if (!\preg_match('/^\+?[1-9]\d{1,14}$/D', $value)) {
             $message = \sprintf(
                 static::generateMessage($message ?: 'Value "%s" is not a valid E164.'),
                 static::stringify($value)
diff --git a/tests/Assert/Tests/AssertTest.php b/tests/Assert/Tests/AssertTest.php
index 849d644..60ac482 100644
--- a/tests/Assert/Tests/AssertTest.php
+++ b/tests/Assert/Tests/AssertTest.php
@@ -782,6 +782,7 @@ public function dataInvalidUrl(): array
             ['http://:password@@symfony.com'],
             ['http://username:passwordsymfony.com'],
             ['http://usern@me:password@symfony.com'],
+            ["http://www.google.com\n"],
         ];
     }
 
@@ -898,6 +899,13 @@ public function testInvalidAlnum()
         Assertion::alnum('1a');
     }
 
+    public function testInvalidAlnumWithTrailingNewline()
+    {
+        $this->expectException('Assert\AssertionFailedException');
+        $this->expectExceptionCode(\Assert\Assertion::INVALID_ALNUM);
+        Assertion::alnum("a1b2c3\n");
+    }
+
     public function testValidTrue()
     {
         $this->assertTrue(Assertion::true(1 == 1));
@@ -1306,6 +1314,7 @@ public function providesInvalidE164s(): array
         return [
             ['+3362652569e'],
             ['+3361231231232652569'],
+            ["+33626525690\n"],
         ];
     }