Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

In my wordpress site I have a hack that looks at the uri and does a redirect to a subdomain. The problem is wp_redirect calls wp_sanitize_redirect which will strip out @ signs, so when a user tries to load something like

oursite.com?email=foo@bar.com

The page that gets loaded should be

prefix.oursite.com?email=foo@bar.com

but instead it's

prefix.oursite.com?email=foobar.com (i.e. - no @ sign)

The problem is easy to work around - I just manually encode @ signs as %40 before calling wp_redirect.

Question: why does wp_sanitize_redirect strip out @ signs, exactly? Anybody could anyway try to load a url with an @ sign in it - is there some security issue I'm not thinking about?

EDIT: The function I'm talking about is wp_sanitize_redirect

share|improve this question
    
I've never seen a function called wp_sanitize_url(). Could you please point to the core file, where it is defined? Thanks. –  kaiser Sep 11 '12 at 14:06
    
My bad, I mean wp_sanitize_redirect. –  PapaFreud Sep 11 '12 at 16:26
add comment

1 Answer 1

up vote 1 down vote accepted

Question why does wp_sanitize_redirect strip out @ signs, exactly? Anybody could anyway try to load a url with an @ sign in it - is there some security issue I'm not thinking about?

Just take a look at the source:

function wp_sanitize_redirect($location) {
    $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%!]|i', '', $location);
    $location = wp_kses_no_null($location);

    // remove %0d and %0a from location
    $strip = array('%0d', '%0a', '%0D', '%0A');
    $location = _deep_replace($strip, $location);
    return $location;
}

So the only characters, the preg_replace allows are

  • lower case a-z
  • numbers
  • and ~+_.?#=&;,/:%!.

What does that mean for URIs and URLs?

The php function urlencode() replaces all no alpha-numeric chararcters, except -_. with a % (percent) character followed by two hexdecimal values and spaces with a +. If you use rawurlencode(), it also strips the +. As you can see from the preg_replace(), it allows all URL encoded/prepared characters, so it's safe to throw such encoded characters/URL parts into the game.

share|improve this answer
    
Right, I see what the regexp is doing, I was wondering why. I mean, why does it not url encode characters rather than strip them out? And is it safe to just url encode @ signs as %40 and then call wp_redirect? Maybe this was a silly question. –  PapaFreud Sep 12 '12 at 5:28
    
Yes, it works - see edit. –  kaiser Sep 12 '12 at 10:38
    
Well I know it works, I mean... oh, never mind. Accepted. Thanks for the trouble. –  PapaFreud Sep 12 '12 at 11:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.