Ticket #36998: 36998.1.diff

src/wp-includes/pluggable.php

@@ -1271 +1271 @@
          * @return string Redirect-sanitized URL.
          */
         function wp_sanitize_redirect( $location ) {
+                // Encode whitespaces.
+                $location = str_replace( ' ', '%20', $location );
+                
                 $regex    = '/
                 (
                         (?: [\xC2-\xDF][\x80-\xBF]        # double-byte sequences   110xxxxx 10xxxxxx

tests/phpunit/tests/pluggable.php

@@ -319 +319 @@
                 return $signatures;
         }
 
+        /**
+         * @group 36998
+         */
+        function test_wp_sanitize_redirect_should_encode_whitespaces() {
+
+                $test_expected_and_values = [
+                        'http://example.com/test%20whitespaces' => 'http://example.com/test%20whitespaces',
+                        'http://example.com/test%20whitespaces%20in%20url' => 'http://example.com/test whitespaces in url'
+                ];
+
+                foreach( $test_expected_and_values as $expected => $value ) {
+                        $this->assertSame( $expected, wp_sanitize_redirect( $value ) );
+                }
+
+        }
+
 }