Bug #3512574: URL un fragment

Closes #3512574

core/lib/Drupal/Component/Utility/UrlHelper.php

@@ -187,13 +187,18 @@ public static function parse($url) {
     ];
 
     // External URLs: not using parse_url() here, so we do not have to rebuild
-    // the scheme, host, and path without having any use for it.
-    // The URL is considered external if it contains the '://' delimiter. Since
-    // a URL can also be passed as a query argument, we check if this delimiter
-    // appears in front of the '?' query argument delimiter.
+    // the scheme, host, and path without having any use for it. The URL is
+    // considered external if it contains the '://' delimiter. Since a URL can
+    // also be passed as a query or fragment argument, check if this delimiter
+    // appears in front of the '?' and '#' query/fragment argument delimiters.
     $scheme_delimiter_position = strpos($url, '://');
     $query_delimiter_position = strpos($url, '?');
-    if ($scheme_delimiter_position !== FALSE && ($query_delimiter_position === FALSE || $scheme_delimiter_position < $query_delimiter_position)) {
+    $fragment_delimiter_position = strpos($url, '#');
+    if (
+      $scheme_delimiter_position !== FALSE &&
+      ($query_delimiter_position === FALSE || $scheme_delimiter_position < $query_delimiter_position) &&
+      ($fragment_delimiter_position === FALSE || $scheme_delimiter_position < $fragment_delimiter_position)
+    ) {
       // Split off the fragment, if any.
       if (str_contains($url, '#')) {
         [$url, $options['fragment']] = explode('#', $url, 2);