Asterisk (*) characters are incorrectly removed in wp_sanitize_redirect

[jkohlbach]

According to the URI spec under section 2.3 Unreserved Characters (​http://www.ietf.org/rfc/rfc2396.txt) the asterisk character (*) is allowed in URI's but wp_sanitize_redirect strips them out.

This send means the user is sent to the wrong URL when using wp_redirect or wp_safe_redirect.

To reproduce, open wp-includes/pluggable.php and drop in some debug in the wp_redirect function:

echo '<pre>DEBUG: ' . print_r($location, true) . '</pre>';
$location = wp_sanitize_redirect($location);
echo '<pre>DEBUG: ' . print_r($location, true) . '</pre>';
die();

Then just use wp_redirect('http://google.com/test=12345*abcdef', 301); and you'll see the * is being stripped incorrectly.

[SergeyBiryukov]

Related: [3926], [3939], [11147].

[miqrogroove]

Why only * ? Other common chars include @ and [ and ] also.

[jkohlbach]

Replying to miqrogroove:

Why only * ? Other common chars include @ and [ and ] also.

As far as I'm aware those chars aren't in the reserved characters list I linked to above.

[SergeyBiryukov]

In 28939:

Asterisk is an allowed character in a URI and should not be stripped out by wp_sanitize_redirect().

fixes #28362.