Changeset 52084 for trunk/src/wp-includes/http.php

Timestamp:

11/09/2021 10:37:19 PM (5 years ago)

Author:

hellofromTonya

Message:

HTTP API: Introduce 'http_allowed_safe_ports' filter in wp_http_validate_url().

Adds a new filter 'http_allowed_safe_ports' to control which ports are allowed for remote requests. By default, ports 80, 443, and 8080 are allowed for safe remote requests.

Adds tests.

Follow-up to [24480].

Props xknown, johnbillion, jorbin, costdev, dd32.
Fixes #54331.

File:

• trunk/src/wp-includes/http.php (modified) (3 diffs)

trunk/src/wp-includes/http.php

@@ -515 +515 @@
  */
 function wp_http_validate_url( $url ) {
+        if ( ! is_string( $url ) || '' === $url || is_numeric( $url ) ) {
+                return false;
+        }
+
         $original_url = $url;
         $url          = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );
@@ -535 +539 @@
 
         $parsed_home = parse_url( get_option( 'home' ) );
-
-        if ( isset( $parsed_home['host'] ) ) {
-                $same_host = strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
-        } else {
-                $same_host = false;
-        }
+        $same_host   = isset( $parsed_home['host'] ) && strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );
+        $host        = trim( $parsed_url['host'], '.' );
 
         if ( ! $same_host ) {
-                $host = trim( $parsed_url['host'], '.' );
                 if ( preg_match( '#^(([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)\.){3}([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)$#', $host ) ) {
                         $ip = $host;
@@ -582 +581 @@
 
         $port = $parsed_url['port'];
-        if ( 80 === $port || 443 === $port || 8080 === $port ) {
+
+        /**
+         * Controls the list of ports considered safe in HTTP API.
+         *
+         * Allows to change and allow external requests for the HTTP request.
+         *
+         * @since 5.9.0
+         *
+         * @param array  $allowed_ports Array of integers for valid ports.
+         * @param string $host          Host name of the requested URL.
+         * @param string $url           Requested URL.
+         */
+        $allowed_ports = apply_filters( 'http_allowed_safe_ports', array( 80, 443, 8080 ), $host, $url );
+        if ( in_array( $port, $allowed_ports, true ) ) {
                 return $url;
         }