Changeset 63307 for trunk

Timestamp:

08/16/2026 04:55:59 PM (3 weeks ago)

Author:

joedolson

Message:

Rewrite Rules: Only a leading www. is optional in url_to_postid().

Fixes the behavior of url_to_postid(), which treated a www. string anywhere in the URL as optional, breaking some URLs. Anchor the string so that is only considered optional when at the beginning of a URL string.

Follow up to [63207].

Props youknowriad, johnbillion, wildworks, irozum, joedolson.
Fixes #65016.

Location:

trunk

Files:

• src/wp-includes/rewrite.php (modified) (2 diffs)
• tests/phpunit/tests/rewrite.php (modified) (1 diff)

trunk/src/wp-includes/rewrite.php

@@ -503 +503 @@
 
         if ( is_string( $url_host ) ) {
-                $url_host = str_replace( 'www.', '', $url_host );
+                // Only a leading 'www.' is optional. Removing it anywhere else would match a different host.
+                $url_host = preg_replace( '|^www\.|', '', $url_host );
         } else {
                 $url_host = '';
@@ -511 +512 @@
 
         if ( is_string( $home_url_host ) ) {
-                $home_url_host = str_replace( 'www.', '', $home_url_host );
+                $home_url_host = preg_replace( '|^www\.|', '', $home_url_host );
         } else {
                 $home_url_host = '';

trunk/tests/phpunit/tests/rewrite.php

@@ -264 +264 @@
 
         /**
+         * Only a leading 'www.' is optional when comparing the URL's host to the site's.
+         *
+         * A 'www.' elsewhere in the host belongs to a different domain, which an attacker
+         * can register: stripping it everywhere makes 'exwww.ample.com' match 'example.com'.
+         *
+         * @ticket 65016
+         *
+         * @covers ::url_to_postid
+         *
+         * @dataProvider data_url_to_postid_host_matching
+         *
+         * @param string $host     Host of the URL to resolve.
+         * @param bool   $is_local Whether the host should be treated as this site.
+         */
+        public function test_url_to_postid_matches_www_prefix_only( $host, $is_local ) {
+                update_option( 'home', 'https://example.com' );
+                update_option( 'siteurl', 'https://example.com' );
+
+                $post_id = self::factory()->post->create();
+
+                $expected = $is_local ? $post_id : 0;
+
+                $this->assertSame( $expected, url_to_postid( "https://$host/?p=$post_id" ) );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array[]
+         */
+        public function data_url_to_postid_host_matching() {
+                return array(
+                        'the site host'              => array( 'example.com', true ),
+                        'the site host with www'     => array( 'www.example.com', true ),
+                        'www inside the domain'      => array( 'exwww.ample.com', false ),
+                        'www inside the TLD'         => array( 'example.cwww.om', false ),
+                        'an unrelated host'          => array( 'evil.com', false ),
+                        'the site host as subdomain' => array( 'example.com.evil.com', false ),
+                );
+        }
+
+        /**
          * @covers ::url_to_postid
          */