>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3603890. --> Reported by: [fmitchell](https://www.drupal.org/user/213574) Related to !8 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p><code>RouteHelper::getRouteNameFromRequest()</code> blindly passes <code>$request-&gt;getPathInfo()</code> to <code>Url::fromUserInput()</code>, which prepends <code>internal:</code> and dispatches to <code>Url::fromInternalUri()</code>. Core's <code>Url::fromInternalUri()</code> throws an <code>InvalidArgumentException</code> when the resulting path component looks like an external URI. For example, a path of <code>/tel:1234567890</code> strips to <code>tel:1234567890</code>, which <code>UrlHelper::isExternal()</code> reports as <code>TRUE</code>.</p> <p>Because <code>ResponseSubscriber::onResponseEvent()</code> is subscribed to <code>KernelEvents::RESPONSE</code> at priority <code>-1000</code> and calls <code>getRouteNameFromRequest()</code> unconditionally on every response, <strong>every</strong> request to a path of this shape, even when no routes are configured to be protected, produces an uncaught exception, turning what would have been a clean 404 from Drupal core into a 500 plus a logged PHP error.</p> <p>This class of bad request seems to be bot- and crawler-generated. Naive HTML link extractors that don't honor the <code>tel:</code> / <code>mailto:</code> URI schemes treat the <code>href</code> value as a relative path and resolve it against the page's host, producing requests like <code>https://example.com/tel:8006564673</code>. Drupal core handles these fine on its own (404, no exception). It is only the presence of this module's response subscriber that escalates them to 500s.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <ol> <li>Install Route Basic Authentication on any Drupal 10 or 11 site.</li> <li>Do <strong>not</strong> configure any <code>protected_routes</code> (the bug reproduces regardless, but the empty-config case proves the module needn't be doing any actual work to fail).</li> <li><code>curl -i https://example.com/tel:8006564673</code> </li></ol> <p><strong>Expected:</strong> HTTP 404 (Drupal core's normal not-found behavior for unrouted paths).</p> <p><strong>Actual:</strong> HTTP 500, with the following entry in <code>watchdog</code>:</p> <pre>InvalidArgumentException: The internal path component 'tel:8006564673' is external.<br>You are not allowed to specify an external URL together with internal:/.<br>in Drupal\Core\Url::fromInternalUri() (line 422 of core/lib/Drupal/Core/Url.php).</pre><p>Backtrace (top frames):</p> <pre>#0 core/lib/Drupal/Core/Url.php(319): Drupal\Core\Url::fromInternalUri()<br>#1 core/lib/Drupal/Core/Url.php(221): Drupal\Core\Url::fromUri()<br>#2 modules/contrib/route_basic_auth/src/Routing/RouteHelper.php(27): Drupal\Core\Url::fromUserInput()<br>#3 modules/contrib/route_basic_auth/src/EventSubscriber/ResponseSubscriber.php(104): Drupal\route_basic_auth\Routing\RouteHelper-&gt;getRouteNameFromRequest()</pre><p>The same fault reproduces for any request path whose first segment parses as an external URI, e.g.:</p> <ul> <li><code>/mailto:foo@example.com</code></li> <li><code>/https://example.com</code></li> <li><code>/http://example.com</code></li> </ul> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Guard <code>RouteHelper::getRouteNameFromRequest()</code> against paths that <code>UrlHelper::isExternal()</code> would classify as external before calling <code>Url::fromUserInput()</code>, and wrap the call in a defensive <code>try/catch</code> for <code>\InvalidArgumentException</code> to cover anything that slips past the scheme check. Return <code>NULL</code> in either case. If the requests cannot match a Drupal route by definition, the module does nothing.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Review patch.</li> <li>Add test coverage for the external-path case in <code>getRouteNameFromRequest()</code>.</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>None</p> <h3 id="summary-api-changes">API changes</h3> <p>None</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None</p>