fix: createFromString() returns URI with invalid hostname

system/HTTP/SiteURIFactory.php

@@ -71,8 +71,9 @@ public function createFromString(string $uri): SiteURI
  }
 
  $relativePath = $parts['path'] . $query . $fragment;
+ $host = $this->getValidHost($parts['host']);
 
- return new SiteURI($this->appConfig, $relativePath, $parts['host'], $parts['scheme']);
+ return new SiteURI($this->appConfig, $relativePath, $host, $parts['scheme']);
  }
 
  /**
@@ -231,21 +232,30 @@ private function createURIFromRoutePath(string $routePath): SiteURI
  }
 
  /**
- * @return string|null The current hostname. Returns null if no host header.
+ * @return string|null The current hostname. Returns null if no valid host.
  */
  private function getHost(): ?string
  {
- $host = null;
-
  $httpHostPort = $this->server['HTTP_HOST'] ?? null;
+
  if ($httpHostPort !== null) {
  [$httpHost] = explode(':', $httpHostPort, 2);
 
- if (in_array($httpHost, $this->appConfig->allowedHostnames, true)) {
- $host = $httpHost;
- }
+ return $this->getValidHost($httpHost);
+ }
+
+ return null;
+ }
+
+ /**
+ * @return string|null The valid hostname. Returns null if not valid.
+ */
+ private function getValidHost(string $host): ?string
+ {
+ if (in_array($host, $this->appConfig->allowedHostnames, true)) {
+ return $host;
  }
 
- return $host;
+ return null;
  }
 }