WordPress.org

Make WordPress Core

Opened 4 years ago

Last modified 2 months ago

#18818 reopened defect (bug)

wp_sanitize_redirect() kills "@" in URL's

Reported by: theandystratton Owned by: theandystratton
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 3.2.1
Component: General Keywords:
Focuses: Cc:

Description

We had a URL like:

http://site.com/path/to/page?email=theandystratton@gmail.com

WP 301's to

http://site.com/path/to/page/?email=theandystratton@gmail.com

But wp_redirect()'s call to wp_sanitize_redirect() kills the "@" symbol. The reason for this being that a theme/plugin could be using query string arguments for something (i.e. form that accepts pre-populated input via query string, like an email address or arbitrary text).

This could have been an oversight OR it could be on purpose, if so, would like to know (I'd assume a security reason).

Attachments (2)

18818.diff (536 bytes) - added by theandystratton 4 years ago.
Allows @ symbol in wp_sanitize_redirect
18818.2.diff (1.5 KB) - added by markjaquith 2 months ago.
refreshed and added a unit test

Download all attachments as: .zip

Change History (7)

@theandystratton4 years ago

Allows @ symbol in wp_sanitize_redirect

comment:1 @nacin4 years ago

The @ symbol is a reserved character in URLs. It's for separating the username from the host. You need to encode it.

As stated in #18814, it may be possible to encode it in query strings only, but I don't think we should.

comment:2 follow-up: @theandystratton4 years ago

Gotcha, makes sense. For some reason I was getting a similar behavior with encoding (%40) but not now. I figured there was probably something I was overlooking in terms of URL structure as reason for why it wasn't there. Thankyasir.

At least I'm 1 step closer to being able to submit a true patch that gets accepted ;]

comment:3 in reply to: ↑ 2 @nacin4 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to invalid
  • Status changed from new to closed

Replying to theandystratton:

At least I'm 1 step closer to being able to submit a true patch that gets accepted ;]

Indeed! :)

comment:4 @markjaquith2 months ago

  • Resolution invalid deleted
  • Status changed from closed to reopened

The @ symbol is a reserved character in URLs. It's for separating the username from the host. You need to encode it.

This is not true, according to RFC 3986. "@" is a perfectly valid character in a URL path or query string. It is only within the "user information" portion of a URL that it is reserved as a delimiter. https://medium.com/@nacin is a valid URL, and "@" shouldn't be stripped out of the path.

comment:5 @SergeyBiryukov2 months ago

  • Milestone set to Awaiting Review

@markjaquith2 months ago

refreshed and added a unit test

Note: See TracTickets for help on using tickets.