From 8278c5ee9c8a16ba71098dc2af96cccb84957e96 Mon Sep 17 00:00:00 2001 From: Pascal Birchler Date: Tue, 16 May 2017 08:37:34 +0000 Subject: [PATCH] Improve redirect handling git-svn-id: https://develop.svn.wordpress.org/trunk@40689 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/class-http.php | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/src/wp-includes/class-http.php b/src/wp-includes/class-http.php index b9f5ab50fb..abee7aa0a5 100644 --- a/src/wp-includes/class-http.php +++ b/src/wp-includes/class-http.php @@ -306,6 +306,11 @@ class WP_Http { // Ensure redirects follow browser behaviour. $options['hooks']->register( 'requests.before_redirect', array( get_class(), 'browser_redirect_compatibility' ) ); + // Validate redirected URLs. + if ( function_exists( 'wp_kses_bad_protocol' ) && $r['reject_unsafe_urls'] ) { + $options['hooks']->register( 'requests.before_redirect', array( get_class(), 'validate_redirects' ) ); + } + if ( $r['stream'] ) { $options['filename'] = $r['filename']; } @@ -466,6 +471,20 @@ class WP_Http { } } + /** + * Validate redirected URLs. + * + * @since 4.7.5 + * + * @throws Requests_Exception On unsuccessful URL validation + * @param string $location URL to redirect to. + */ + public static function validate_redirects( $location ) { + if ( ! wp_http_validate_url( $location ) ) { + throw new Requests_Exception( __('A valid URL was not provided.'), 'wp_http.redirect_failed_validation' ); + } + } + /** * Tests which transports are capable of supporting the request. *