Changeset 63062 for trunk

Timestamp:

08/06/2026 03:32:33 PM (7 weeks ago)

Author:

johnbillion

Message:

HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.

Props johnbillion, westonruter, paulkevan, ehtis, jeremyfelt.

File:

• trunk/src/wp-includes/http.php (modified) (1 diff)

trunk/src/wp-includes/http.php

@@ -596 +596 @@
                 if ( $ip ) {
                         $parts = array_map( 'intval', explode( '.', $ip ) );
-                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
-                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
-                                || ( 192 === $parts[0] && 168 === $parts[1] )
+
+                        /*
+                         * These IP address ranges are not considered valid external hosts for HTTP requests.
+                         *
+                         * If the host resolves to an IP address in these ranges, the request will be rejected unless the 'http_request_host_is_external' filter allows it.
+                         *
+                         * References:
+                         *
+                         * - IPv4 Special-Purpose Address Space: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+                         * - IPv4 Multicast Address Assignments: https://www.rfc-editor.org/rfc/rfc5771.html
+                         */
+                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]          // 127.0.0.0/8 (loopback), 10.0.0.0/8 (private), 0.0.0.0/8 (this network).
+                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )     // 172.16.0.0/12 (private).
+                                || ( 192 === $parts[0] && 168 === $parts[1] )                      // 192.168.0.0/16 (private).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 0 === $parts[2] )     // 192.0.0.0/24 (IETF protocol assignments).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 2 === $parts[2] )     // 192.0.2.0/24 (TEST-NET-1).
+                                || ( 192 === $parts[0] && 88 === $parts[1] && 99 === $parts[2] )   // 192.88.99.0/24 (6to4 relay anycast).
+                                || ( 198 === $parts[0] && 51 === $parts[1] && 100 === $parts[2] )  // 198.51.100.0/24 (TEST-NET-2).
+                                || ( 203 === $parts[0] && 0 === $parts[1] && 113 === $parts[2] )   // 203.0.113.0/24 (TEST-NET-3).
+                                || ( 169 === $parts[0] && 254 === $parts[1] )                      // 169.254.0.0/16 (link-local and cloud metadata).
+                                || ( 100 === $parts[0] && 64 <= $parts[1] && 127 >= $parts[1] )    // 100.64.0.0/10 (CGNAT).
+                                || ( 198 === $parts[0] && 18 <= $parts[1] && 19 >= $parts[1] )     // 198.18.0.0/15 (benchmarking).
+                                || ( 224 <= $parts[0] && 239 >= $parts[0] )                        // 224.0.0.0/4 (multicast).
+                                || 240 <= $parts[0]                                                // 240.0.0.0/4 (reserved, includes 255.255.255.255 broadcast).
                         ) {
                                 // If host appears local, reject unless specifically allowed.