From e7447543891a429dd0c1541ad96cb154eb44f1a6 Mon Sep 17 00:00:00 2001
From: Keith Solomon <keith@vincentdesign.ca>
Date: Sun, 26 Apr 2026 14:45:17 -0500
Subject: [PATCH] fix: avoid userinfo url rewrites

---
 src/Url/UrlTransformer.php            |  2 +-
 tests/Unit/Url/UrlTransformerTest.php | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/Url/UrlTransformer.php b/src/Url/UrlTransformer.php
index 23e77ce..c64cdce 100644
--- a/src/Url/UrlTransformer.php
+++ b/src/Url/UrlTransformer.php
@@ -56,7 +56,7 @@ final class UrlTransformer {
 			$sources
 		);
 
-		return '~(?<![A-Za-z0-9.-])(?:' . implode( '|', $quoted ) . ')(?![A-Za-z0-9.-])~';
+		return '~(?<![A-Za-z0-9.-])(?:' . implode( '|', $quoted ) . ')(?![A-Za-z0-9.@-])~';
 	}
 
 	private function toProtocolRelative( string $url ): string {
diff --git a/tests/Unit/Url/UrlTransformerTest.php b/tests/Unit/Url/UrlTransformerTest.php
index 1645897..9a7cd1a 100644
--- a/tests/Unit/Url/UrlTransformerTest.php
+++ b/tests/Unit/Url/UrlTransformerTest.php
@@ -114,6 +114,23 @@ class UrlTransformerTest extends TestCase {
 		);
 	}
 
+	public function test_it_does_not_rewrite_userinfo_host_lookalikes(): void {
+		$transformer = new UrlTransformer();
+		$mappings    = new UrlMappingCollection(
+			array(
+				new UrlMapping( 'https://example.test', 'https://staging.example.test' ),
+			)
+		);
+
+		self::assertSame(
+			'https://example.test@evil.test/path https://staging.example.test/path',
+			$transformer->transformString(
+				'https://example.test@evil.test/path https://example.test/path',
+				$mappings
+			)
+		);
+	}
+
 	public function test_it_prefers_more_specific_overlapping_mappings(): void {
 		$transformer = new UrlTransformer();
 		$mappings    = new UrlMappingCollection(