Security vulnerability in Laravel’s URL validator

routes.php

<?php

/**
 * Imagine if this came from the request or a database entry editable by the user.
 * The Laravel URL validator relies on PHP's filter_var() method which considers
 * file:// and php:// valid URLs. The vast majority of Laravel users probably
 * expect this validator to only validate http:// & https://
 * @link http://www.php.net/manual/en/wrappers.php
 */

Route::get('/', function () {

    $url = 'file:///etc/hosts';

    $validator = \Validator::make
        (
            ['url' => $url],
            ['url' => 'url']
        );

    if ($validator->passes()) {
        return file_get_contents($url);
    }

});

Well that seems bad.. bad/10 actually.

Very very bad :/

Has this been patched in any recent Laravel updates?

illuminate/validation@de809db