esc_url() cannot handle IPv6 literal URLs in PHP < 5.4.7

[johnbillion]

In PHP < 5.4.7, parse_url() cannot handle IPv6 literal URLs such as //[::FFFF::127.0.0.1]/. This means esc_url() cannot correctly handle such URLs because it relies on parse_url() to separate the domain/port from the path/query in order to determine whether to encode square brackets or not.

Prior to [34920], esc_url() blindly stripped all square brackets and didn't use parse_url().

[johnbillion]

34202.tests.diff​ adds tests from #16859 to demonstrate the problem.

[swissspidy]

#34054 was marked as a duplicate.

[swissspidy]

esc_url also breaks when an IPv6 address is used in a query arg, e.g. http://example.org/?s=2001:0db8:0000:0000:0000:ff00:0042:8329. It just returns an empty string in that case.

See #34054

[dd32]

Replying to swissspidy:

esc_url also breaks when an IPv6 address is used in a query arg, e.g. http://example.org/?s=2001:0db8:0000:0000:0000:ff00:0042:8329. It just returns an empty string in that case.

I can't duplicate that under Trunk, does this also require the specific version of PHP?

[swissspidy]

Replying to dd32:

Replying to swissspidy:

esc_url also breaks when an IPv6 address is used in a query arg, e.g. http://example.org/?s=2001:0db8:0000:0000:0000:ff00:0042:8329. It just returns an empty string in that case.

I can't duplicate that under Trunk, does this also require the specific version of PHP?

Just noticed that this happens when using a relative URL like edit-comments.php?s=2001:0db8:0000:0000:0000:ff00:0042:8329. In that case esc_url() returns an empty string. Not for edit-comments.php?s=192.168.50.1 however. That works as expected.

[johnbillion]

I suspect the above issue is caused by the relative URL handling in esc_url() which looks for the presence of a colon to determine whether it's a relative URL or not. That can go in its own ticket.

[dd32]

Replying to johnbillion:

I suspect the above issue is caused by the relative URL handling in esc_url() which looks for the presence of a colon to determine whether it's a relative URL or not. That can go in its own ticket.

Split off to #34407

[dd32]

In 35368:

Comments: Use a full URL rather than a relative one for links which can contain IPv6 addresses to avoid an issue where the URL was being eaten by escaping functions.

See #34407, #34202
Fixes #34054

[dd32]

Small clarification to the original description - parse_url() cannot handle schemeless IPv6 URLs prior to PHP 5.4.7, http://[...]/ is fine, //[...]/ isn't.

[dd32]

In 35370:

Use wp_parse_url() in esc_url() to avoid parsing bugs in < PHP 5.4.7.

Props johnbillion for unit tests
See #34408
Fixes #34202