Changeset 30444

Timestamp:

11/20/2014 02:00:56 PM (10 years ago)

Author:

nacin

Message:

Better validation of the URL used in core HTTP requests.

Merges [30443] to the 4.0 branch.

Location:

branches/4.0

Files:

• . (modified) (1 prop)
• src/wp-includes/http.php (modified) (3 diffs)

branches/4.0/src/wp-includes/http.php

@@ -445 +445 @@
  */
 function wp_http_validate_url( $url ) {
+    $original_url = $url;
     $url = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
-    if ( ! $url )
+    if ( ! $url || strtolower( $url ) !== strtolower( $original_url ) )
         return false;
 
@@ -456 +457 @@
         return false;
 
-    if ( false !== strpos( $parsed_url['host'], ':' ) )
+    if ( false !== strpbrk( $parsed_url['host'], ':#?[]' ) )
         return false;
 
@@ -474 +475 @@
         if ( $ip ) {
             $parts = array_map( 'intval', explode( '.', $ip ) );
-            if ( '127.0.0.1' === $ip
-                || ( 10 === $parts[0] )
+            if ( 127 === $parts[0] || 10 === $parts[0]
                 || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
                 || ( 192 === $parts[0] && 168 === $parts[1] )