wp_sanitize_redirect() kills "@" in URL's

[theandystratton]

We had a URL like:

​http://site.com/path/to/page?email=theandystratton@gmail.com

WP 301's to

​http://site.com/path/to/page/?email=theandystratton@gmail.com

But wp_redirect()'s call to wp_sanitize_redirect() kills the "@" symbol. The reason for this being that a theme/plugin could be using query string arguments for something (i.e. form that accepts pre-populated input via query string, like an email address or arbitrary text).

This could have been an oversight OR it could be on purpose, if so, would like to know (I'd assume a security reason).

[theandystratton]

Allows @ symbol in wp_sanitize_redirect

[nacin]

The @ symbol is a reserved character in URLs. It's for separating the username from the host. You need to encode it.

As stated in #18814, it may be possible to encode it in query strings only, but I don't think we should.

[theandystratton]

Gotcha, makes sense. For some reason I was getting a similar behavior with encoding (%40) but not now. I figured there was probably something I was overlooking in terms of URL structure as reason for why it wasn't there. Thankyasir.

At least I'm 1 step closer to being able to submit a true patch that gets accepted ;]

[nacin]

Replying to theandystratton:

At least I'm 1 step closer to being able to submit a true patch that gets accepted ;]

Indeed! :)

[markjaquith]

The @ symbol is a reserved character in URLs. It's for separating the username from the host. You need to encode it.

This is not true, according to RFC 3986. "@" is a perfectly valid character in a URL path or query string. It is only within the "user information" portion of a URL that it is reserved as a delimiter. ​https://medium.com/@nacin is a valid URL, and "@" shouldn't be stripped out of the path.

[markjaquith]

refreshed and added a unit test

[DrewAPicture]

18818.2.diff​ still applies and unit tests pass. Moving for consideration.

[wonderboymusic]

In 33707:

In wp_sanitize_redirect(), don't eat @ characters. According to RFC 3986, "@" is a perfectly valid character in a URL path or query string.

Adds unit test.

Props markjaquith.
Fixes #18818.