Ticket #32816: 32816.2.diff

src/wp-admin/css/customize-nav-menus.css

@@ -559 +559 @@
 
 #custom-menu-item-name.invalid,
 #custom-menu-item-url.invalid,
+.edit-menu-item-url.invalid,
 .menu-name-field.invalid,
 .menu-name-field.invalid:focus,
 #available-menu-items .new-content-item .create-item-input.invalid,

src/wp-admin/js/customize-nav-menus.js

@@ -1387 +1387 @@
                  */
                 _setupUpdateUI: function() {
                         var control = this,
-                                settingValue = control.setting();
+                                settingValue = control.setting(),
+                                updateNotifications;
 
                         control.elements = {};
                         control.elements.url = new api.Element( control.container.find( '.edit-menu-item-url' ) );
@@ -1470 +1471 @@
                                         }
                                 }
                         });
+
+                        // Style the URL field as invalid when there is an invalid_url notification.
+                        updateNotifications = _.debounce( function() {
+                                control.elements.url.element.toggleClass( 'invalid', control.setting.notifications.has( 'invalid_url' ) );
+                        } );
+                        control.setting.notifications.bind( 'add', updateNotifications );
+                        control.setting.notifications.bind( 'remove', updateNotifications );
                 },
 
                 /**

src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php

@@ -641 +641 @@
          * @since 4.3.0
          *
          * @param array $menu_item_value The value to sanitize.
-         * @return array|false|null Null if an input isn't valid. False if it is marked for deletion.
+         * @return array|false|null|WP_Error Null if an input isn't valid. False if it is marked for deletion.
          *                          Otherwise the sanitized value.
          */
         public function sanitize( $menu_item_value ) {
@@ -701 +701 @@
                 $menu_item_value['attr_title'] = wp_unslash( apply_filters( 'excerpt_save_pre', wp_slash( $menu_item_value['attr_title'] ) ) );
                 $menu_item_value['description'] = wp_unslash( apply_filters( 'content_save_pre', wp_slash( $menu_item_value['description'] ) ) );
 
-                $menu_item_value['url'] = esc_url_raw( $menu_item_value['url'] );
+                if ( '' !== $menu_item_value['url'] ) {
+                        $menu_item_value['url'] = esc_url_raw( $menu_item_value['url'] );
+                        if ( '' === $menu_item_value['url'] ) {
+                                return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) ); // Fail sanitization if URL is invalid.
+                        }
+                }
                 if ( 'publish' !== $menu_item_value['status'] ) {
                         $menu_item_value['status'] = 'draft';
                 }

tests/phpunit/tests/customize/nav-menu-item-setting.php

@@ -472 +472 @@
                 $this->assertNull( $setting->sanitize( 'not an array' ) );
                 $this->assertNull( $setting->sanitize( 123 ) );
 
+                $valid_urls = array(
+                        'http://example.com/',
+                        'https://foo.example.com/hello.html',
+                        'mailto:nobody@example.com?subject=hi',
+                        'ftp://example.com/',
+                        'ftps://example.com/',
+                        'news://news.server.example/example.group.this',
+                        'irc://irc.freenode.net/wordpress',
+                        'gopher://example.com',
+                        'nntp://news.server.example/example.group.this',
+                        'feed://example.com/',
+                        'telnet://example.com',
+                        'mms://example.com',
+                        'rtsp://example.com/',
+                        'svn://develop.svn.wordpress.org/trunk',
+                        'tel:000-000-000',
+                        'fax:000-000-000',
+                        'xmpp:user@host?message',
+                        'webcal://example.com',
+                        'urn:org.wordpress',
+                );
+                foreach ( $valid_urls as $valid_url ) {
+                        $url_setting = $setting->sanitize( array( 'url' => $valid_url ) );
+                        $this->assertInternalType( 'array', $url_setting );
+                        $this->assertEquals( $valid_url, $url_setting['url'] );
+                }
+
+                $invalid_urls = array(
+                        'javascript:alert(1)',
+                        'unknown://something.out-there',
+                        'smtp://user:pass@mailserver.thing',
+                );
+                foreach ( $invalid_urls as $invalid_url ) {
+                        $url_setting = $setting->sanitize( array( 'url' => $invalid_url ) );
+                        $this->assertInstanceOf( 'WP_Error', $url_setting );
+                        $this->assertEquals( 'invalid_url', $url_setting->get_error_code() );
+                }
+
                 $unsanitized = array(
                         'object_id' => 'bad',
                         'object' => '<b>hello</b>',
@@ -479 +517 @@
                         'position' => -123,
                         'type' => 'custom<b>',
                         'title' => '\o/ o\'o Hi<script>unfilteredHtml()</script>',
-                        'url' => 'javascript:alert(1)',
+                        'url' => '',
                         'target' => '" onclick="',
                         'attr_title' => '\o/ o\'o <b>bolded</b><script>unfilteredHtml()</script>',
                         'description' => '\o/ o\'o <b>Hello world</b><script>unfilteredHtml()</script>',