Changeset 60734

Timestamp:

09/12/2025 10:03:25 PM (2 months ago)

Author:

SergeyBiryukov

Message:

Formatting: Allow specifying https:// as the default protocol in esc_url().

esc_url() will now prepend https:// to the URL if it does not already contain a scheme and the first item in the $protocols array is 'https'.

Follow-up to [5088], [6015], [13299], [33851], [60672].

Props sabernhardt, mkaz, rachelbaker, audrasjb, costdev, aksl95, johnbillion, pcarvalho, SergeyBiryukov.
Fixes #52886.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (2 diffs)
• tests/phpunit/tests/formatting/escUrl.php (modified) (2 diffs)

trunk/src/wp-includes/formatting.php

@@ -4643 +4643 @@
  *
  * @since 2.8.0
+ * @since 6.9.0 Prepends `https://` to the URL if it does not already contain a scheme
+ *              and the first item in `$protocols` is 'https'.
  *
  * @param string   $url       The URL to be cleaned.
@@ -4675 +4677 @@
      * If the URL doesn't appear to contain a scheme, we presume
      * it needs http:// prepended (unless it's a relative link
-     * starting with /, # or ?, or a PHP file).
+     * starting with /, # or ?, or a PHP file). If the first item
+     * in $protocols is 'https', then https:// is prepended.
      */
     if ( ! str_contains( $url, ':' ) && ! in_array( $url[0], array( '/', '#', '?' ), true ) &&
         ! preg_match( '/^[a-z0-9-]+?\.php/i', $url )
     ) {
-        $url = 'http://' . $url;
+        $scheme = ( is_array( $protocols ) && 'https' === array_first( $protocols ) ) ? 'https://' : 'http://';
+        $url    = $scheme . $url;
     }
 

trunk/tests/phpunit/tests/formatting/escUrl.php

@@ -91 +91 @@
 
     /**
+     * @ticket 23605
+     * @ticket 52886
+     *
      * @covers ::wp_allowed_protocols
      */
@@ -97 +100 @@
         $this->assertSame( '', esc_url( 'nasty://example.com/' ) );
         $this->assertSame(
-            '',
+            'https://example.com',
             esc_url(
                 'example.com',
                 array(
+                    'https',
+                )
+            )
+        );
+        $this->assertSame(
+            'http://example.com',
+            esc_url(
+                'example.com',
+                array(
+                    'http',
+                )
+            )
+        );
+        $this->assertSame(
+            'https://example.com',
+            esc_url(
+                'example.com',
+                array(
+                    'https',
+                    'http',
+                )
+            )
+        );
+        $this->assertSame(
+            'http://example.com',
+            esc_url(
+                'example.com',
+                array(
+                    'http',
                     'https',
                 )