WordPress.org

Make WordPress Core

Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#29886 closed defect (bug) (fixed)

WP_HTTP::make_absolute_url() treats schemeless URLs as relative

Reported by: dd32 Owned by: dd32
Milestone: 4.1 Priority: normal
Severity: normal Version: 4.1
Component: HTTP API Keywords:
Focuses: Cc:

Description

Currently if you pass WP_HTTP::make_absolute_url() a scheme-less url, it's converted to a absolute url based on the current domain, ignoring the host of the schemeless url.

Although Schemeless URL's are invalid in HTTP Headers, since this is a helper function used elsewhere, and because many systems don't follow the specifications strictly, we should handle schemeless url's correctly.

The correct option for this function appears to be to convert it to a protocol relative url, safe for use in a HTTP request.

Change History (5)

#1 @dd32
5 years ago

  • Owner set to dd32
  • Resolution set to fixed
  • Status changed from new to closed

In 29851:

Correctly support Schemeless URLs in WP_HTTP::make_absolute_url() by respecting the 'host' field if present in the relative url.
Fixes #29886

#2 @jorbin
5 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

#4 @dd32
5 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 29861:

Handle deficiencies in PHP's parse_url in older versions of PHP (<5.4.7) in WP_HTTP::make_absolute_url().

In older versions of PHP:

  • parse_url() will fail to parse a url where the scheme break (:) is present in a relative URL's path
  • parse_url() will include the hostname of a schemeless URL in the path component

This handles those two types of URL's by correcting the response from parse_url().

Fixes #28001, #29886

#5 @dd32
5 years ago

In 29864:

Add some unit tests for WP_HTTP::parse_url() to cover the <PHP 5.4.7 compatibility alterations.

These unit tests cover the expected vehaviour of certain combinations of URL's, but makes no attempt to test invalid URL structures, as PHP's behavious for invalid URL's is undefined (Some will be treated as paths, others fail, and it varies between PHP 5.4.7+ and <5.4.7).
This change also makes WP_HTTP::parse_url() protected in order to allow unit testing.
See #28001, #29886

Note: See TracTickets for help on using tickets.