Validate Canonical field URLs match retrieval location

[Copilot]

Implemented validation for the Canonical field as specified in RFC 9116 section 2.5.2.

If this field appears within a "security.txt" file and the URI used to retrieve that file is not listed within any canonical fields, then the contents of the file SHOULD NOT be trusted.

Changes Made

• New violation class: SecurityTxtCanonicalUrlMismatch warns when the fetched URL doesn't match any canonical URLs
• Validation logic: CanonicalUrlFieldValidator in Validator\Validators namespace validates that the retrieval URL is listed in the Canonical field
• Implements FieldValidator: Validator implements the standard FieldValidator interface and is added to the $fieldValidators array
• SecurityTxt stores fetched URL: Added withFetchedUrl() and getFetchedUrl() methods to store the retrieval URL context
• Parser integration: parseString() sets fetched URL on SecurityTxt object before validation when fetch result is available
• Dynamic format generation: Violation messages use individual placeholders for each URL (singular/plural aware)
• Strict mode support: Files with mismatched canonical URLs are marked invalid in strict mode

Implementation Details

1. CanonicalUrlFieldValidator - Implements FieldValidator interface, validates canonical URLs by checking getFetchedUrl() on SecurityTxt
2. SecurityTxt - Added withFetchedUrl() and getFetchedUrl() methods to store fetch context
3. SecurityTxtValidator - Includes CanonicalUrlFieldValidator in $fieldValidators array alongside other field validators
4. SecurityTxtParser::parseString() - Sets fetched URL on SecurityTxt before validation when fetch result is available
5. Uniform validation - All validators run through the same loop with no special handling

Behavior

When a security.txt file is fetched and contains a Canonical field that doesn't list the retrieval URL:

[Warning] The file was fetched from https://example.com/.well-known/security.txt 
          but the Canonical field does not list this URL
[Warning] (How to fix: Add the URL https://example.com/.well-known/security.txt 
          to the Canonical field, or ensure the file is fetched from the listed 
          canonical URL: https://www.example.com/.well-known/security.txt)

No validation occurs when:

• The Canonical field is absent (per RFC, it's optional)
• Validating without a fetch result (e.g., parseString() called directly without fetchResult parameter)

Multiple canonical URLs are supported—validation passes if any matches the retrieval URL.

Testing

• ✅ Manual testing with example from issue (michalspacek.cz)
• ✅ Unit tests for canonical URL mismatch, match, and absent scenarios
• ✅ Code review and security checks completed
• ✅ Functionality validated with and without fetch result context

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Validate the Canonical field</issue_title>
<issue_description>> If this field appears within a "security.txt" file and the URI used to retrieve that file is not listed within any canonical fields, then the contents of the file SHOULD NOT be trusted.

https://www.rfc-editor.org/rfc/rfc9116#section-2.5.2-3

Right now the result of the check of michalspacek.cz (no www) is fine:

$ bin/checksecuritytxt.php michalspacek.cz --no-ipv6
[Info] Parsing security.txt for michalspacek.cz
[Info] Loading security.txt from https://michalspacek.cz/.well-known/security.txt
[Info] Loading security.txt from https://michalspacek.cz/security.txt
[Info] Redirected from https://michalspacek.cz/security.txt to https://michalspacek.cz/.well-known/security.txt
[Info] Selecting security.txt located at https://michalspacek.cz/.well-known/security.txt for further tests
[Info] The file will expire in 271 days (2026-09-01T00:00:00+00:00)
[Info] Signature valid, key 4BD4C403AF2F9FCCB151FE61B64BDD6E464AB529, signed on 2025-09-23T15:02:54+00:00

But the Canonical field URL is with www:

spaze@over9k:~/libs/security-txt@main$ curl https://michalspacek.cz/.well-known/security.txt | grep Canonical
Canonical: https://www.michalspacek.cz/.well-known/security.txt
```</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes Validate the Canonical field #40

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[spaze]

Superseded by #44