Fix secure-http check to avoid bypass using emojis

src/Composer/Config.php

@@ -584,8 +584,8 @@ class Config
      */
     public function prohibitUrlByConfig(string $url, ?IOInterface $io = null, array $repoOptions = []): void
     {
-        // Return right away if the URL is malformed or custom (see issue #5173)
-        if (false === filter_var($url, FILTER_VALIDATE_URL)) {
+        // Return right away if the URL is malformed or custom (see issue #5173), but only for non-HTTP(S) URLs
+        if (false === filter_var($url, FILTER_VALIDATE_URL) && !Preg::isMatch('{^https?://}', $url)) {
             return;
         }
 

tests/Composer/Test/ConfigTest.php

@@ -294,6 +294,7 @@ class ConfigTest extends TestCase
             'http://packagist.org',
             'http://10.1.0.1/satis',
             'http://127.0.0.1/satis',
+            'http://💛@example.org',
             'svn://localhost/trunk',
             'svn://will.not.resolve/trunk',
             'svn://192.168.0.1/trunk',