![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 7 years ago
Last modified 44 hours ago
#46791 reopened defect (bug)
esc_url() adding http:// to a relative URL to parent directory '../pathname/'
| Reported by: | OrangePixelNath | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Future Release |
| Component: | Formatting | Version: | 5.1 |
| Severity: | normal | Keywords: | has-patch has-unit-tests has-test-info |
| Cc: | Focuses: |
Description
esc_url() adds 'http://' when it shouldn't.
Line 4191 wp-includes/formatting.php states
If the URL doesn't appear to contain a scheme, we presume it needs http:// prepended (unless a relative link starting with /, # or ? or a php file).
This is prepending http:// to a relative url to a parent directory i.e. ../path-to-page/
Funtion needs ../ adding to the array or some regex code.
Attachments (2)
Change History (15)
#4
follow-up:
↓ 5
@
7 years ago
- Keywords has-patch added; needs-patch removed
@OrangePixelNath did you mean to close this ticket? If so, can you detail why? What did you discover that made your report incorrect or unnecessary?
#5
in reply to: ↑ 4
@
7 years ago
- Resolution worksforme
- Status closed → reopened
Replying to desrosj:
@OrangePixelNath did you mean to close this ticket? If so, can you detail why? What did you discover that made your report incorrect or unnecessary?
No sorry. I'm new to the system so didn't understand what was next.
#6
@
7 years ago
- Keywords needs-testing added
No problem! That’s why I checked m :)
Next, the ticket stays open for community members to text and review.
#7
@
6 months ago
- Keywords needs-refresh added; needs-testing removed
The patch doesn't apply cleanly; it fails with the error:
Running "patch:46791" (patch) task ? Please select a patch to apply 46791-2.diff (782 bytes) - adde d by subrataemfluence 7 years ago. patching file wp-includes/formatting.php Hunk #1 FAILED at 4190. 1 out of 1 hunk FAILED -- saving rejects to file wp-includes/formatting.php.rej
Patch needs a refresh and removing needs-testing.
This ticket was mentioned in PR #10849 on WordPress/wordpress-develop by @sabernhardt.
6 months ago
#8
- Keywords has-unit-tests added; needs-refresh removed
Does not prepend the fallback protocol when the reference starts with a dot (./ or ../).
This ticket was mentioned in Slack in #core by adrianduffell. View the logs.
3 days ago
#12
@
2 days ago
- Keywords has-test-info added
Patch testing report
Patch / PR tested
- https://github.com/WordPress/wordpress-develop/pull/10849
- trunk @ 1e1d954dfd with PR diff applied (branch
esc_url-relative-paths)
Environment
WordPress: 7.1-beta1-62760-src
PHP: 8.2.18 (Docker)
MySQL: 8.0.36 (Docker)
OS: macOS 26.5.2
Tested via: WP-CLIwp eval+ PHPUnit (server-side formatting function, no UI)
Local wordpress-develop @ http://localhost:8889
Steps
- On trunk, call
esc_url()with directory-relative references and observe the output. - Apply PR #10849 and call
esc_url()with the same inputs. - Confirm non-relative inputs are unaffected (real domains, fragments, queries, scheme'd URLs).
- Run the
escUrlPHPUnit test class.
Results
- Bug on trunk: pass —
esc_url('../parent-directory')returnshttp://../parent-directory(and./, deep../../../../likewise gethttp://prepended). - Fix, parent/current dir: pass —
../parent-directory,./current-directory,../../../../up-four-directoriesare returned unchanged. - Fix, ticket example: pass —
esc_url('../path-to-page/')returns../path-to-page/. - Relative with query/fragment: pass —
./a/b?x=1#ypreserved. - No regression (real domain): pass —
example.comstill returnshttp://example.com. - No regression (other relatives / schemes): pass —
/example.php,example.php,#fragment,?foo=bar,http://example.com/,https://example.com/,ftp://x.com/all unchanged. - Unit tests: pass — full
escUrlclass OK (19 tests, 129 assertions), including the updatedtest_relative()(7 assertions).
Conclusion
PR #10849 adds . to the array of first characters that mark a URL as a relative link in esc_url(), so ./ and ../ directory-relative references are no longer given a fallback http:// prefix. The change is minimal (a one-character functional edit plus a comment update) and well scoped to the ticket, with matching unit-test coverage. No backward-compatibility concern found: real domains and already-scheme'd URLs are unaffected. Minor note: any leading . is now treated as relative (e.g. .hidden stays .hidden), which is harmless since a hostname cannot begin with a bare dot. Recommend commit.
Proposed patch.