Changeset 52084 for trunk/src/wp-includes/http.php

Timestamp:

11/09/2021 10:37:19 PM (4 years ago)

Author:

hellofromTonya

Message:

HTTP API: Introduce 'http_allowed_safe_ports' filter in wp_http_validate_url().

Adds a new filter 'http_allowed_safe_ports' to control which ports are allowed for remote requests. By default, ports 80, 443, and 8080 are allowed for safe remote requests.

Adds tests.

Follow-up to [24480].

Props xknown, johnbillion, jorbin, costdev, dd32.
Fixes #54331.

File:

• trunk/src/wp-includes/http.php (modified) (3 diffs)

trunk/src/wp-includes/http.php

@@ -515 +515 @@
  */
 function wp_http_validate_url( $url ) {
+    if ( ! is_string( $url ) || '' === $url || is_numeric( $url ) ) {
+        return false;
+    }
+
     $original_url = $url;
     $url          = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
@@ -535 +539 @@
 
     $parsed_home = parse_url( get_option( 'home' ) );
-
-    if ( isset( $parsed_home['host'] ) ) {
-        $same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
-    } else {
-        $same_host = false;
-    }
+    $same_host   = isset( $parsed_home['host'] ) && strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
+    $host        = trim( $parsed_url['host'], '.' );
 
     if ( ! $same_host ) {
-        $host = trim( $parsed_url['host'], '.' );
         if ( preg_match( '#^(([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)\.){3}([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)$#', $host ) ) {
             $ip = $host;
@@ -582 +581 @@
 
     $port = $parsed_url['port'];
-    if ( 80 === $port || 443 === $port || 8080 === $port ) {
+
+    /**
+     * Controls the list of ports considered safe in HTTP API.
+     *
+     * Allows to change and allow external requests for the HTTP request.
+     *
+     * @since 5.9.0
+     *
+     * @param array  $allowed_ports Array of integers for valid ports.
+     * @param string $host          Host name of the requested URL.
+     * @param string $url           Requested URL.
+     */
+    $allowed_ports = apply_filters( 'http_allowed_safe_ports', array( 80, 443, 8080 ), $host, $url );
+    if ( in_array( $port, $allowed_ports, true ) ) {
         return $url;
     }