Make WordPress Core


Ignore:
Timestamp:
10/07/2015 11:38:22 PM (9 years ago)
Author:
johnbillion
Message:

Avoid stripping square brackets from URLs, and instead correctly encode them. Square brackets must be encoded in the path, path parameters, query parameters, and fragment, but must not be encoded in anything up to the domain and port.

Adds tests.

Fixes #16859

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/tests/phpunit/tests/formatting/EscUrl.php

    r34675 r34920  
    4141
    4242    function test_all_url_parts() {
    43         $url = 'https://user:password@host.example.com:1234/path;p=1?q=2&r=3#fragment';
    44         $this->assertEquals( $url, esc_url_raw( $url ) );
    45 
    46         $this->assertEquals( 'https://user:password@host.example.com:1234/path;p=1?q=2&r=3#fragment', esc_url( $url ) );
    47 
    48         $this->assertEquals( 'http://example.com?foo', esc_url( 'http://example.com?foo' ) );
     43        $url = 'https://user:pass@host.example.com:1234/path;p=1?query=2&r[]=3#fragment';
     44
     45        $this->assertEquals( array(
     46            'scheme'   => 'https',
     47            'host'     => 'host.example.com',
     48            'port'     => 1234,
     49            'user'     => 'user',
     50            'pass'     => 'pass',
     51            'path'     => '/path;p=1',
     52            'query'    => 'query=2&r[]=3',
     53            'fragment' => 'fragment',
     54        ), parse_url( $url ) );
     55        $this->assertEquals( 'https://user:pass@host.example.com:1234/path;p=1?query=2&r%5B%5D=3#fragment', esc_url_raw( $url ) );
     56        $this->assertEquals( 'https://user:pass@host.example.com:1234/path;p=1?query=2&r%5B%5D=3#fragment', esc_url( $url ) );
    4957    }
    5058
    5159    function test_bare() {
     60        $this->assertEquals( 'http://example.com?foo', esc_url( 'example.com?foo' ) );
    5261        $this->assertEquals( 'http://example.com', esc_url( 'example.com' ) );
    5362        $this->assertEquals( 'http://localhost', esc_url( 'localhost' ) );
     
    127136
    128137    /**
     138     * @ticket 16859
     139     */
     140    function test_square_brackets() {
     141        $this->assertEquals( '/example.php?one%5B%5D=two', esc_url( '/example.php?one[]=two' ) );
     142        $this->assertEquals( '?foo%5Bbar%5D=baz', esc_url( '?foo[bar]=baz' ) );
     143        $this->assertEquals( '//example.com/?foo%5Bbar%5D=baz', esc_url( '//example.com/?foo[bar]=baz' ) );
     144        $this->assertEquals( 'http://example.com/?foo%5Bbar%5D=baz', esc_url( 'example.com/?foo[bar]=baz' ) );
     145        $this->assertEquals( 'http://localhost?foo%5Bbar%5D=baz', esc_url( 'localhost?foo[bar]=baz' ) );
     146        $this->assertEquals( 'http://example.com/?foo%5Bbar%5D=baz', esc_url( 'http://example.com/?foo[bar]=baz' ) );
     147        $this->assertEquals( 'http://example.com/?foo%5Bbar%5D=baz', esc_url( 'http://example.com/?foo%5Bbar%5D=baz' ) );
     148        $this->assertEquals( 'http://example.com/?baz=bar&foo%5Bbar%5D=baz', esc_url( 'http://example.com/?baz=bar&foo[bar]=baz' ) );
     149        $this->assertEquals( 'http://example.com/?baz=bar&foo%5Bbar%5D=baz', esc_url( 'http://example.com/?baz=bar&foo%5Bbar%5D=baz' ) );
     150    }
     151
     152    /**
     153     * Courtesy of http://blog.lunatech.com/2009/02/03/what-every-web-developer-must-know-about-url-encoding
     154     */
     155    function test_reserved_characters() {
     156        $url = "http://example.com/:@-._~!$&'()*+,=;:@-._~!$&'()*+,=:@-._~!$&'()*+,==?/?:@-._~!$%27()*+,;=/?:@-._~!$%27()*+,;==#/?:@-._~!$&'()*+,;=";
     157        $this->assertEquals( $url, esc_url_raw( $url ) );
     158    }
     159
     160    /**
    129161     * @ticket 21974
    130162     */
     
    176208     */
    177209    function test_invalid_charaters() {
    178         $this->assertEmpty( esc_url_raw('"^[]<>{}`') );
     210        $this->assertEmpty( esc_url_raw('"^<>{}`') );
    179211    }
    180212
Note: See TracChangeset for help on using the changeset viewer.