[wp-trac] [WordPress Trac] #34202: esc_url() cannot handle IPv6 literal URLs in PHP < 5.4.7

[WordPress Trac]

#34202: esc_url() cannot handle IPv6 literal URLs in PHP < 5.4.7
----------------------------------------+------------------------------
 Reporter:  johnbillion                 |       Owner:
     Type:  defect (bug)                |      Status:  new
 Priority:  low                         |   Milestone:  Awaiting Review
Component:  Formatting                  |     Version:  3.1
 Severity:  normal                      |  Resolution:
 Keywords:  needs-patch has-unit-tests  |     Focuses:
----------------------------------------+------------------------------

Old description:

> In PHP < 5.4.7, `parse_url()` cannot handle IPv6 literal URLs such as
> `http://[::FFFF::127.0.0.1]/`. This means `esc_url()` cannot correctly
> handle such URLs because it relies on `parse_url()` to separate the
> domain/port from the path/query in order to determine whether to encode
> square brackets or not.
>
> Prior to [34920], `esc_url()` blindly stripped all square brackets and
> didn't use `parse_url()`.

New description:

 In PHP < 5.4.7, `parse_url()` cannot handle IPv6 literal URLs such as
 `//[::FFFF::127.0.0.1]/`. This means `esc_url()` cannot correctly handle
 such URLs because it relies on `parse_url()` to separate the domain/port
 from the path/query in order to determine whether to encode square
 brackets or not.

 Prior to [34920], `esc_url()` blindly stripped all square brackets and
 didn't use `parse_url()`.

--

Comment (by dd32):

 Small clarification to the original description - `parse_url()` cannot
 handle '''schemeless IPv6 URLs''' prior to PHP 5.4.7, `http://[...]/` is
 fine, `//[...]/` isn't.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/34202#comment:9>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform