esc_url_raw (esc_url) throw "Uninitialized string offset: 0" with invalid chars

[mmems]

esc_url_raw('"^[]<>{}`');

Will throw "Uninitialized string offset: 0" because the length of resulting string (after filtering all invalid chars) is not tested before check if it's a relative URL

if ( strpos($url, ':') === false && ! in_array( $url[0], array( '/', '#', '?' ) ) ...
-----------------------------------------------------^

[jesin]

Check if $url is empty after sanitization before checking its first character

[jesin]

Use substr() to select the first character of $url

[jesin]

The second patch is cleaner and does the same thing without adding additional conditions like empty().

The substr() function was used before 3.2. Please check if the patch works for all kinds of input.

[mmems]

The error disappear now, but:

esc_url_raw('"^[]<>{}`');
// now returns: "http://"

Maybe the emptiness test should be after chars filtering :

$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
$strip = array('%0d', '%0a', '%0D', '%0A');
$url = _deep_replace($strip, $url);
$url = str_replace(';//', '://', $url);
if ( '' == $url )
	return $url;

Instead of:

if ( '' == $url )
	return $url;
$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
$strip = array('%0d', '%0a', '%0D', '%0A');
$url = _deep_replace($strip, $url);
$url = str_replace(';//', '://', $url);

[jesin]

Slight modification to 28015.diff

[jesin]

The third patch should fix it. Let me know if it works for you.

[mmems]

It's ok now (for my following test case "<>[\]^`{})

[jesin]

Refreshed 28015.3.diff and added an unit test

[johnbillion]

In 28015.5.diff​: If a URL is so malformed that it contains only characters which get stripped out, then the function should bail out early, as it does for an empty URL.

[johnbillion]

In 33923:

Bail out early from esc_url() if the URL becomes empty after stripping out disallowed characters.

Fixes #28015
Props jesin for the unit test