From 884ede71d145054cc4f7681bd10560586f823f57 Mon Sep 17 00:00:00 2001
From: Volker Dusch <volker@thephp.foundation>
Date: Wed, 10 Jun 2026 02:05:31 +0200
Subject: [PATCH] Fix uuid() accepting {, }, and prefixes inside the string

Instead of stripping "urn:", "uuid:", "{" and "}" from anywhere in the value before matching.

So strings like "5{}50e8400-..." or an interior "urn:" passed the assertion and the un-normalised string was returned to the caller.

Moved the validated into the regex:

- The prefixes are only accepted at the start
- A leading "{" must be paired with a closing "}" using a PCRE conditional
---
 lib/Assert/Assertion.php          |  8 +-------
 tests/Assert/Tests/AssertTest.php | 12 ++++++++++++
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/lib/Assert/Assertion.php b/lib/Assert/Assertion.php
index 81bc978..f399751 100644
--- a/lib/Assert/Assertion.php
+++ b/lib/Assert/Assertion.php
@@ -1974,13 +1974,7 @@ public static function isJsonString($value, $message = null, ?string $propertyPa
      */
     public static function uuid($value, $message = null, ?string $propertyPath = null): bool
     {
-        $value = \str_replace(['urn:', 'uuid:', '{', '}'], '', $value);
-
-        if ('00000000-0000-0000-0000-000000000000' === $value) {
-            return true;
-        }
-
-        if (!\preg_match('/^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/', $value)) {
+        if (!\preg_match('/^(?:urn:)?(?:uuid:)?(\{)?[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}(?(1)\})$/D', $value)) {
             $message = \sprintf(
                 static::generateMessage($message ?: 'Value "%s" is not a valid UUID.'),
                 static::stringify($value)
diff --git a/tests/Assert/Tests/AssertTest.php b/tests/Assert/Tests/AssertTest.php
index 849d644..09cca10 100644
--- a/tests/Assert/Tests/AssertTest.php
+++ b/tests/Assert/Tests/AssertTest.php
@@ -1256,6 +1256,12 @@ public function providesValidUuids(): array
             ['ff6f8cb0-c57d-51e1-9b21-0800200c9a66'],
             ['FF6F8CB0-C57D-11E1-9B21-0800200C9A66'],
             ['00000000-0000-0000-0000-000000000000'],
+            ['urn:uuid:ff6f8cb0-c57d-11e1-9b21-0800200c9a66'],
+            ['urn:ff6f8cb0-c57d-11e1-9b21-0800200c9a66'],
+            ['uuid:ff6f8cb0-c57d-11e1-9b21-0800200c9a66'],
+            ['{ff6f8cb0-c57d-11e1-9b21-0800200c9a66}'],
+            ['urn:uuid:{ff6f8cb0-c57d-11e1-9b21-0800200c9a66}'],
+            ['{00000000-0000-0000-0000-000000000000}'],
         ];
     }
 
@@ -1267,6 +1273,12 @@ public function providesInvalidUuids(): array
             ['ff6f8cb0-c57da-51e1-9b21-0800200c9a66'],
             ['af6f8cb-c57d-11e1-9b21-0800200c9a66'],
             ['3f6f8cb0-c57d-11e1-9b21-0800200c9a6'],
+            ['{ff6f8cb0-c57d-11e1-9b21-0800200c9a66'],
+            ['ff6f8cb0-c57d-11e1-9b21-0800200c9a66}'],
+            ['ff6f8cb0-{c57d}-11e1-9b21-0800200c9a66'],
+            ['ff6f8cb0-c57d-11e1-9b21-0800uuid:200c9a66'],
+            ["ff6f8cb0-c57d-11e1-9b21-0800200c9a66\n"],
+            ["{ff6f8cb0-c57d-11e1-9b21-0800200c9a66}\n"],
         ];
     }