Changeset 63104 for branches/5.8/src/wp-includes/http.php

Timestamp:

08/06/2026 07:46:36 PM (7 weeks ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 5.8 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
• Editor: Fix output for post date block.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 5.8 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

File:

• branches/5.8/src/wp-includes/http.php (modified) (1 diff)

branches/5.8/src/wp-includes/http.php

@@ -554 +554 @@
                 if ( $ip ) {
                         $parts = array_map( 'intval', explode( '.', $ip ) );
-                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
-                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
-                                || ( 192 === $parts[0] && 168 === $parts[1] )
+
+                        /*
+                         * These IP address ranges are not considered valid external hosts for HTTP requests.
+                         *
+                         * If the host resolves to an IP address in these ranges, the request will be rejected unless the 'http_request_host_is_external' filter allows it.
+                         *
+                         * References:
+                         *
+                         * - IPv4 Special-Purpose Address Space: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+                         * - IPv4 Multicast Address Assignments: https://www.rfc-editor.org/rfc/rfc5771.html
+                         */
+                        if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]          // 127.0.0.0/8 (loopback), 10.0.0.0/8 (private), 0.0.0.0/8 (this network).
+                                || ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )     // 172.16.0.0/12 (private).
+                                || ( 192 === $parts[0] && 168 === $parts[1] )                      // 192.168.0.0/16 (private).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 0 === $parts[2] )     // 192.0.0.0/24 (IETF protocol assignments).
+                                || ( 192 === $parts[0] && 0 === $parts[1] && 2 === $parts[2] )     // 192.0.2.0/24 (TEST-NET-1).
+                                || ( 192 === $parts[0] && 88 === $parts[1] && 99 === $parts[2] )   // 192.88.99.0/24 (6to4 relay anycast).
+                                || ( 198 === $parts[0] && 51 === $parts[1] && 100 === $parts[2] )  // 198.51.100.0/24 (TEST-NET-2).
+                                || ( 203 === $parts[0] && 0 === $parts[1] && 113 === $parts[2] )   // 203.0.113.0/24 (TEST-NET-3).
+                                || ( 169 === $parts[0] && 254 === $parts[1] )                      // 169.254.0.0/16 (link-local and cloud metadata).
+                                || ( 100 === $parts[0] && 64 <= $parts[1] && 127 >= $parts[1] )    // 100.64.0.0/10 (CGNAT).
+                                || ( 198 === $parts[0] && 18 <= $parts[1] && 19 >= $parts[1] )     // 198.18.0.0/15 (benchmarking).
+                                || ( 224 <= $parts[0] && 239 >= $parts[0] )                        // 224.0.0.0/4 (multicast).
+                                || 240 <= $parts[0]                                                // 240.0.0.0/4 (reserved, includes 255.255.255.255 broadcast).
                         ) {
                                 // If host appears local, reject unless specifically allowed.