Make WordPress Core

Opened 5 years ago

Last modified 5 years ago

#49510 new defect (bug)

Regular expression metacharacters in category and tag base lead rewrite rules to fail.

Reported by: raaaahman's profile raaaahman Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.3.2
Component: Rewrite Rules Keywords:
Focuses: administration Cc:

Description (last modified by SergeyBiryukov)

Steps to reproduce (theme Twenty Twenty):

  1. Go to Settings > Permalinks, search for the Category base and/or a Tag base with some [RegExp meta-characters](https://www.php.net/manual/en/regexp.reference.meta.php), for example:


  1. Try to access a category archive page, either by typing its URL directly in your web browser, or by clicking on a generated link for this category:


  1. Same for tag archive page:


I've done some research, and it seems that a similar bug happen with feeds URL: #43571

The proposed solution in the above patch is to escape the rewrite rules with PHP built in function preg_quote(), which would solve this problem too if we apply it in the correct location. But what is the correct location? And could other parts of the rewrite rules generation/evaluation benefits of escaping too?

I don't know if it should be discussed in the same ticket, but after solving this issue, this would allow WordPress administrators to use reserved characters (as defined in [RFC 3986](https://tools.ietf.org/html/rfc3986#section-2.2) in their URLs...

Attachments (3)

permalinks.png (104.4 KB) - added by raaaahman 5 years ago.
category-page.png (99.1 KB) - added by raaaahman 5 years ago.
tag-page.png (99.5 KB) - added by raaaahman 5 years ago.

Download all attachments as: .zip

Change History (4)

@raaaahman
5 years ago

@raaaahman
5 years ago

#1 @SergeyBiryukov
5 years ago

  • Description modified (diff)
Note: See TracTickets for help on using tickets.