Bracket characters ( and ) are incorrectly removed from wp_sanitize_redirect

[jkohlbach]

According to the URI spec under section 2.3 Unreserved Characters (​http://www.ietf.org/rfc/rfc2396.txt) the bracket characters ( and ) are allowed in URI's but wp_sanitize_redirect strips them out.

This means the user is sent to the wrong URL when using wp_redirect or wp_safe_redirect.

To reproduce, open wp-includes/pluggable.php and drop in some debug in the wp_redirect function:

echo '<pre>DEBUG: ' . print_r($location, true) . '</pre>';
$location = wp_sanitize_redirect($location);
echo '<pre>DEBUG: ' . print_r($location, true) . '</pre>';
die();

Then just use wp_redirect('​http://google.com/test=(12345)abcdef', 301); and you'll see the brackets are being stripped incorrectly.

[SergeyBiryukov]

Related/duplicate: #17052, #26037.

[jkohlbach]

Replying to SergeyBiryukov:

Related/duplicate: #17052, #26037.

Hi Sergey,

That other ticket is for square brackets, not rounded brackets, ideally they should be both fixed :)

Cheers,
Josh

[voldemortensen]

This excludes parenthesis from the preg_replace and includes unit tests.

[jkohlbach]

Looks good to me, thanks voldemortensen

[johnbillion]

In 30684:

Allow brackets in a URL when it's sanitised for a redirect. Brackets are valid in query parameters.

Fixes #30308
Props voldemortensen