Changeset 60734

Timestamp:

09/12/2025 10:03:25 PM (13 months ago)

Author:

SergeyBiryukov

Message:

Formatting: Allow specifying https:// as the default protocol in esc_url().

esc_url() will now prepend https:// to the URL if it does not already contain a scheme and the first item in the $protocols array is 'https'.

Follow-up to [5088], [6015], [13299], [33851], [60672].

Props sabernhardt, mkaz, rachelbaker, audrasjb, costdev, aksl95, johnbillion, pcarvalho, SergeyBiryukov.
Fixes #52886.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (2 diffs)
• tests/phpunit/tests/formatting/escUrl.php (modified) (2 diffs)

trunk/src/wp-includes/formatting.php

@@ -4643 +4643 @@
  *
  * @since 2.8.0
+ * @since 6.9.0 Prepends `https://` to the URL if it does not already contain a scheme
+ *              and the first item in `$protocols` is 'https'.
  *
  * @param string   $url       The URL to be cleaned.
@@ -4675 +4677 @@
          * If the URL doesn't appear to contain a scheme, we presume
          * it needs http:// prepended (unless it's a relative link
-         * starting with /, # or ?, or a PHP file).
+         * starting with /, # or ?, or a PHP file). If the first item
+         * in $protocols is 'https', then https:// is prepended.
          */
         if ( ! str_contains( $url, ':' ) && ! in_array( $url[0], array( '/', '#', '?' ), true ) &&
                 ! preg_match( '/^[a-z0-9-]+?\.php/i', $url )
         ) {
-                $url = 'http://' . $url;
+                $scheme = ( is_array( $protocols ) && 'https' === array_first( $protocols ) ) ? 'https://' : 'http://';
+                $url    = $scheme . $url;
         }
 

trunk/tests/phpunit/tests/formatting/escUrl.php

@@ -91 +91 @@
 
         /**
+         * @ticket 23605
+         * @ticket 52886
+         *
          * @covers ::wp_allowed_protocols
          */
@@ -97 +100 @@
                 $this->assertSame( '', esc_url( 'nasty://example.com/' ) );
                 $this->assertSame(
-                        '',
+                        'https://example.com',
                         esc_url(
                                 'example.com',
                                 array(
+                                        'https',
+                                )
+                        )
+                );
+                $this->assertSame(
+                        'http://example.com',
+                        esc_url(
+                                'example.com',
+                                array(
+                                        'http',
+                                )
+                        )
+                );
+                $this->assertSame(
+                        'https://example.com',
+                        esc_url(
+                                'example.com',
+                                array(
+                                        'https',
+                                        'http',
+                                )
+                        )
+                );
+                $this->assertSame(
+                        'http://example.com',
+                        esc_url(
+                                'example.com',
+                                array(
+                                        'http',
                                         'https',
                                 )