Comment link cannot contain IRIs

[link92]

If you try and create a comment with a link such as "​http://www.詹姆斯.com/" it is rewritten to "​http://www..com/", which isn't overly useful.

[josephscott]

I've confirmed in -trunk that if you put the example link above in the URL field of the comment form that strips the domain out. I'll see what I can do to track it down.

[ryan]

clean_url() doesn't handle IRIs.

[josephscott]

The function that is eating this is clean_url() in wp-includes/formatting.php. It doesn't support characters outside of US-ASCII (as Ryan mentioned). I didn't see and obvious/easy/well tested solution to this issue and given the potential risks (we have to filter URLs) this will have stay a 2.4 target at this point I think.

[ryan]

I'll add a filter to clean_url() so that some someone can write a plugin as a stop-gap while we figure out the best approach.

[ryan]

(In [5952]) Add clean_url filter. see #4570

[ryan]

Oops, accidentally committed a taxonomy change along with that. Ignore that, formatting.php has the change relevant to this ticket.

[ryan]

Added clean_url filter that accepts the cleaned url and the original url as args. A plugin can take the original url, filter it in an IRI friendly way, and pass it back.

[westi]

Not sure this is currently fixed - just filterable leaving open for now.

[yogipress]

did we resolve this?

if not,
do we want to create a function is_iri( ) to check before we take original url then filter it?

[nbachiyski]

The problem is not only with IRIs, the current scheme doesn't allow other widely used characters, like parens (#5668). IMHO we should allow any characters and just escape them accordingly -- #5663.

[guillep2k]

By RFC 3987 (​http://tools.ietf.org/html/rfc3987#section-2.1), the unicode characters outside the US-ASCII repertoire are not reserved, and therefore cannot be used for syntactical purposes. This should make them suitable for any URL and shouldn't pose a security problem (at least I hope so!).

I don't see how Wordpress can process these characters if it's not set up for using UTF-8, but anyway here's a patch. It should be thoroughly tested, though, because I had to modify the make_clickable() presentation filter as well (used to filter comment_text when displaying comments).

[nbachiyski]

I wrote a ​couple of tests (search for test_iri) and the proposed patch passes them and all the previous make_clickable() tests pass too.

[ryan]

(In [8525]) Allow IRIs. Props guillep2k. fixes #4570