bug #49376 [HttpFoundation] Deprecate passing invalid URI to Request::create (neclimdul)

This PR was merged into the 6.3 branch.

Discussion
----------

[HttpFoundation] Deprecate passing invalid URI to Request::create

Fixes: #47084

Passing an invalid URI to Request::create triggers an undefined code path. In PHP7 the false value returned by parse_url would quietly be treated as a an array through type coercion leading to unexpected results. In PHP8 this triggers a deprecation exposing the bug.

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | yes
| Tickets       | Fix #47084
| License       | MIT

Commits
-------

bce4c27097 [HttpFoundation] Deprecate passing invalid URI to Request::create

Author: fabpot

Request.php

@@ -342,6 +342,10 @@ public static function create(string $uri, string $method = 'GET', array $parame
         $server['REQUEST_METHOD'] = strtoupper($method);
 
         $components = parse_url($uri);
+        if (false === $components) {
+            trigger_deprecation('symfony/http-foundation', '6.3', 'Calling "%s()" with an invalid URI is deprecated.', __METHOD__);
+            $components = [];
+        }
         if (isset($components['host'])) {
             $server['SERVER_NAME'] = $components['host'];
             $server['HTTP_HOST'] = $components['host'];

Tests/RequestTest.php

@@ -2554,6 +2554,15 @@ public function testReservedFlags()
             $this->assertNotSame(0b10000000, $value, sprintf('The constant "%s" should not use the reserved value "0b10000000".', $constant));
         }
     }
+
+    /**
+     * @group legacy
+     */
+    public function testInvalidUriCreationDeprecated()
+    {
+        $this->expectDeprecation('Since symfony/http-foundation 6.3: Calling "Symfony\Component\HttpFoundation\Request::create()" with an invalid URI is deprecated.');
+        Request::create('/invalid-path:123');
+    }
 }
 
 class RequestContentProxy extends Request