Merge branch '4.4' into 5.4

* 4.4:
  [Mailer] Stream timeout not detected due to checking only string result of function fgets
  don not set http_version instead of setting it to null
  [DependencyInjection] don't move locator tag for service subscriber
  Fix the notification email theme for asynchronously dispatched emails
  Update actions in the CI to move away from the deprecated runtime
  Use 6.3 for new features
  [HttpFoundation] Check IPv6 is valid before comparing it
  Run tests with UTC to avoid daylight saving time messing with assertions
  Bump Symfony version to 4.4.49
  Update VERSION for 4.4.48
  Update CONTRIBUTORS for 4.4.48
  Update CHANGELOG for 4.4.48

Author: nicolas-grekas

IpUtils.php

@@ -135,6 +135,15 @@ public static function checkIp6(?string $requestIp, string $ip)
             throw new \RuntimeException('Unable to check Ipv6. Check that PHP was not compiled with option "disable-ipv6".');
         }
 
+        // Check to see if we were given a IP4 $requestIp or $ip by mistake
+        if (str_contains($requestIp, '.') || str_contains($ip, '.')) {
+            return self::$checkedIps[$cacheKey] = false;
+        }
+
+        if (!filter_var($requestIp, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
+            return self::$checkedIps[$cacheKey] = false;
+        }
+
         if (str_contains($ip, '/')) {
             [$address, $netmask] = explode('/', $ip, 2);
 

Tests/IpUtilsTest.php

@@ -74,6 +74,10 @@ public function getIpv6Data()
             [false, '}__test|O:21:"JDatabaseDriverMysqli":3:{s:2', '::1'],
             [false, '2a01:198:603:0:396e:4789:8e99:890f', 'unknown'],
             [false, '', '::1'],
+            [false, '127.0.0.1', '::1'],
+            [false, '0.0.0.0/8', '::1'],
+            [false,  '::1', '127.0.0.1'],
+            [false,  '::1', '0.0.0.0/8'],
         ];
     }