sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Formatting: Make sure wp_sanitize_redirect() encodes spaces in URLs instead of stripping them out.

Browse Source 
Props donmhico, hlashbrooke, dd32, azaozz.
Fixes #36998.

git-svn-id: https://develop.svn.wordpress.org/trunk@46462 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Sergey Biryukov 2019-10-11 23:52:11 +00:00
parent dcb037fc3a
commit 9a6bce9f5c
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/wp-includes/pluggable.php
View File

@ -1280,6 +1280,9 @@ if ( ! function_exists( 'wp_sanitize_redirect' ) ) :
* @return string Redirect-sanitized URL. * @return string Redirect-sanitized URL.
*/ */
function wp_sanitize_redirect( $location ) { function wp_sanitize_redirect( $location ) {
// Encode spaces.
$location = str_replace( ' ', '%20', $location );
$regex = '/ $regex = '/
( (
(?: [\xC2-\xDF][\x80-\xBF] # double-byte sequences 110xxxxx 10xxxxxx (?: [\xC2-\xDF][\x80-\xBF] # double-byte sequences 110xxxxx 10xxxxxx
@ -1296,7 +1299,7 @@ if ( ! function_exists( 'wp_sanitize_redirect' ) ) :
$location = preg_replace( '|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()@]|i', '', $location ); $location = preg_replace( '|[^a-z0-9-~+_.?#=&;,/:%!*\[\]()@]|i', '', $location );
$location = wp_kses_no_null( $location ); $location = wp_kses_no_null( $location );
// remove %0d and %0a from location // Remove %0D and %0A from location.
$strip = array( '%0d', '%0a', '%0D', '%0A' ); $strip = array( '%0d', '%0a', '%0D', '%0A' );
return _deep_replace( $strip, $location ); return _deep_replace( $strip, $location );
} }

8
tests/phpunit/tests/formatting/redirect.php
View File

@ -36,6 +36,14 @@ class Tests_Formatting_Redirect extends WP_UnitTestCase {
$this->assertEquals( 'http://example.com/@username', wp_sanitize_redirect( 'http://example.com/@username' ) ); $this->assertEquals( 'http://example.com/@username', wp_sanitize_redirect( 'http://example.com/@username' ) );
} }
/**
* @group 36998
*/
function test_wp_sanitize_redirect_should_encode_spaces() {
$this->assertEquals( 'http://example.com/test%20spaces', wp_sanitize_redirect( 'http://example.com/test%20spaces' ) );
$this->assertEquals( 'http://example.com/test%20spaces%20in%20url', wp_sanitize_redirect( 'http://example.com/test spaces in url' ) );
}
/** /**
* @dataProvider valid_url_provider * @dataProvider valid_url_provider
*/ */