WordPress.org

Make WordPress Core

Changeset 31587


Ignore:
Timestamp:
02/28/2015 02:20:52 AM (6 years ago)
Author:
pento
Message:

When sanitizing a URL to redirect to, UTF-8 characters can be URL encoded, instead of being removed.

While RFC 3986 does not specify which character sets are allowed in URIs, Section 2.5 states that octects matching UTF-8 character encoding should be percent-encoded, then unreserved octets outside of the UTF-8 range should be percent-encoded. As browsers tend to only implement support for UTF-8 in URLs, this change only implements the UTF-8 encoding part. We may revisit the second part if it becomes an issue.

Fixes #31486

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/pluggable.php

    r31561 r31587  
    12021202 **/
    12031203function wp_sanitize_redirect($location) {
     1204    $regex = '/
     1205        (
     1206            (?: [\xC2-\xDF][\x80-\xBF]        # double-byte sequences   110xxxxx 10xxxxxx
     1207            |   \xE0[\xA0-\xBF][\x80-\xBF]    # triple-byte sequences   1110xxxx 10xxxxxx * 2
     1208            |   [\xE1-\xEC][\x80-\xBF]{2}
     1209            |   \xED[\x80-\x9F][\x80-\xBF]
     1210            |   [\xEE-\xEF][\x80-\xBF]{2}
     1211            |   \xF0[\x90-\xBF][\x80-\xBF]{2} # four-byte sequences   11110xxx 10xxxxxx * 3
     1212            |   [\xF1-\xF3][\x80-\xBF]{3}
     1213            |   \xF4[\x80-\x8F][\x80-\xBF]{2}
     1214        ){1,50}                              # ...one or more times
     1215        )/x';
     1216    $location = preg_replace_callback( $regex, '_wp_sanitize_utf8_in_redirect', $location );
    12041217    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()]|i', '', $location);
    12051218    $location = wp_kses_no_null($location);
     
    12091222    $location = _deep_replace($strip, $location);
    12101223    return $location;
     1224}
     1225
     1226/**
     1227 * URL encode UTF-8 characters in a URL.
     1228 *
     1229 * @ignore
     1230 * @since 4.2.0
     1231 * @access private
     1232 *
     1233 * @see wp_sanitize_redirect()
     1234 */
     1235function _wp_sanitize_utf8_in_redirect( $matches ) {
     1236    return urlencode( $matches[0] );
    12111237}
    12121238endif;
  • trunk/tests/phpunit/tests/formatting/redirect.php

    r30684 r31587  
    1212        $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0dgo'));
    1313        $this->assertEquals('http://example.com/watchtheallowedcharacters-~+_.?#=&;,/:%!*stay', wp_sanitize_redirect('http://example.com/watchtheallowedcharacters-~+_.?#=&;,/:%!*stay'));
     14        $this->assertEquals('http://example.com/watchtheutf8convert%F0%9D%8C%86', wp_sanitize_redirect("http://example.com/watchtheutf8convert\xf0\x9d\x8c\x86"));
    1415        //Nesting checks
    1516        $this->assertEquals('http://example.com/watchthecarriagereturngo', wp_sanitize_redirect('http://example.com/watchthecarriagereturn%0%0ddgo'));
Note: See TracChangeset for help on using the changeset viewer.