Opened 11 months ago
Last modified 11 months ago
#64170 new defect (bug)
gethostbyname() in validating URLs does not work for IPv6
| Reported by: | frankieandshadow | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Future Release |
| Component: | HTTP API | Version: | 6.8.3 |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description
Summary:
wp_http_validate_url() rejects valid URLs when the hostname resolves to IPv6-only addresses, because gethostbyname() only supports IPv4. I discovered this with a custom plugin repository in a IPv6 only network (so the DNS only has a AAAA record when it validates the URL provided to fetch the plugin package).
Expected behavior:
URLs with hostnames that resolve to IPv6 addresses should be validated successfully.
Actual behavior:
When a hostname resolves only to IPv6, gethostbyname() returns the hostname unchanged, which the function treats as a DNS lookup failure and rejects the URL.
How to reproduce:
Create a hostname that resolves only to IPv6 (AAAA record, no A record)
Try to use that URL in any WordPress HTTP API call with default settings
The URL will be rejected with "A valid URL was not provided"
Suggested fix:
Replace gethostbyname() with dns_get_record() or similar that supports both IPv4 and IPv6 (or use getaddrinfo() via a PHP extension.
Workaround:
Set reject_unsafe_urls to false in http_request_args filter for affected URLs.
Change History (2)
#1
@
11 months ago
- Component Plugins → HTTP API
- Keywords needs-patch added
- Milestone Awaiting Review → Future Release
This ticket was mentioned in PR #10444 on WordPress/wordpress-develop by JezerM.
11 months ago
#2
- Keywords has-patch has-unit-tests added; needs-patch removed
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
This PR implements a function for getting the IP for a hostname, similar to
gethostbynamebut also working for IPv6. So, hosts likeipv6.google.comwould be valid URLs and the hostname would be correctly obtained.Trac ticket: https://core.trac.wordpress.org/ticket/64170