\Uri\Rfc3986\Uri does not handle some non-encoded characters (`@`, `[`)

[earthiverse]

Description

The following code:

var_dump(new \Uri\Rfc3986\Uri("http://media-store.localhost/img/store/31/bc/0ef8ebbc4035984ef59aa595cf4f7ee8d068/%C3%89t%C3%89@%C3%89b%C3%89g%C3%89o%C3%85[%C3%89K%C3%85[%C3%87Q.jpg"));

Resulted in this output:

PHP Warning:  Uncaught Uri\InvalidUriException: The specified URI is malformed

But I expected this output instead:

class Uri\Rfc3986\Uri#2 (8) {
  public $scheme =>
  string(4) "http"
  public $username =>
  NULL
  public $password =>
  NULL
  public $host =>
  string(21) "media-store.localhost"
  public $port =>
  NULL
  public $path =>
  string(118) "/img/store/31/bc/0ef8ebbc4035984ef59aa595cf4f7ee8d068/%C3%89t%C3%89@%C3%89b%C3%89g%C3%89o%C3%85[%C3%89K%C3%85[%C3%87Q.jpg"
  public $query =>
  NULL
  public $fragment =>
  NULL
}

---

I'm not too sure about RFC 3986, but I copied that URL straight from my browser's URL, and it didn't encode the @ or [ characters when I copied it. If I percent-encode those, it parses OK.

https://en.wikipedia.org/wiki/Percent-encoding#Reserved_characters says "reserved characters that have no reserved purpose in a particular context may also be percent-encoded but are not semantically different from those that are not."

PHP Version

PHP 8.5.3 (cli) (built: Feb 10 2026 18:25:51) (NTS)
Copyright (c) The PHP Group
Built by Shivam Mathur
Zend Engine v4.5.3, Copyright (c) Zend Technologies
    with Xdebug v3.5.1, Copyright (c) 2002-2026, by Derick Rethans
    with Zend OPcache v8.5.3, Copyright (c), by Zend Technologies

Operating System

MacOS Tahoe 26.3.1

[kocsismate]

In fact, your browser follows the WHATWG URL specification, while RFC 3986 is much stricter, and doesn't automatically correct percent-encoding. For example, let's see the same input with WHATWG URL:

https://3v4l.org/qsJfI#v8.5.0

As you can see, the $errors variable contains soft-errors about the invalid [ character indeed. RFC 3986 just throws an Exception when the URI is not correct.

With that said, I'm closing this issue.