Make WordPress Core

Opened 13 years ago

Closed 11 years ago

#19032 closed defect (bug) (fixed)

home_url() malfunctions when the passed URL contains two dots in a row ("..")

Reported by: markjaquith's profile markjaquith Owned by: markjaquith's profile markjaquith
Milestone: 3.6 Priority: high
Severity: normal Version: 2.6
Component: General Keywords: has-patch 2nd-opinion
Focuses: Cc:


home_url() (and a bunch of other similar functions) will spit back your WordPress Site URL if the URL/path you pass in to it has two dots ("..") in a row. It was an unexplained addition to the original code that has persisted.


echo home_url( '/foo-bar/' );



It is due to this:

if ( !empty( $path ) && is_string( $path ) && strpos( $path, '..' ) === false )
    $url .= '/' . ltrim( $path, '/' );

We should just remove that part of the condition. It doesn't serve any legitimate purpose that Nacin or I can tell, and it makes legitimate URLs with two (or more) dots fail in a very unexpected way.

Attachments (3)

19032.diff (4.0 KB) - added by markjaquith 13 years ago.
19032-unit-test.patch (2.7 KB) - added by kurtpayne 12 years ago.
Unit test
19032-unit-test.2.patch (2.3 KB) - added by kurtpayne 11 years ago.

Download all attachments as: .zip

Change History (14)

13 years ago

#1 @markjaquith
13 years ago

  • Keywords has-patch 2nd-opinion needs-unit-tests added
  • Owner set to markjaquith
  • Status changed from new to accepted

Patch removes that part of the logic from 10 functions. Someone else test and give me a sanity check.

#2 @nacin
13 years ago

In IRC we tracked this down to #7001. It was codified into unit tests, specifically TestSSLLinks::test_admin_url_invalid(), but I think the original case was invalid. We're talking about URL paths rather than anything that will touch the filesystem.

#4 @nacin
13 years ago

  • Version set to 2.6

12 years ago

Unit test

#5 @kurtpayne
12 years ago

  • Cc kpayne@… added
  • Keywords needs-unit-tests removed

#7 @wonderboymusic
11 years ago

  • Milestone changed from Awaiting Review to 3.6

#8 @kurtpayne
11 years ago

Updated unit test for the new test runner. Verified test still fails without patch and still passes with patch.

#9 @ocean90
11 years ago

#23489 was marked as a duplicate.

#10 @nacin
11 years ago

In 1225/tests:

Test for allowing .. in paths passed to *_url functions. see #19032.

#11 @nacin
11 years ago

  • Resolution set to fixed
  • Status changed from accepted to closed

In 23537:

Allow paths with two consecutive dots to be passed to home_url() and all related *_url() functions.

props markjaquith.
fixes #19032.

Note: See TracTickets for help on using tickets.