wp_is_authorize_application_redirect_url_valid( string $url ): true|WP_Error

Source

function wp_is_authorize_application_redirect_url_valid( $url ) {
	$bad_protocols = array( 'javascript', 'data' );
	if ( empty( $url ) ) {
		return true;
	}

	// Based on https://www.rfc-editor.org/rfc/rfc2396#section-3.1
	$valid_scheme_regex = '/^[a-zA-Z][a-zA-Z0-9+.-]*:/';
	if ( ! preg_match( $valid_scheme_regex, $url ) ) {
		return new WP_Error(
			'invalid_redirect_url_format',
			__( 'Invalid URL format.' )
		);
	}

	/**
	 * Filters the list of invalid protocols used in applications redirect URLs.
	 *
	 * @since 6.3.2
	 *
	 * @param string[] $bad_protocols Array of invalid protocols.
	 * @param string   $url The redirect URL to be validated.
	 */
	$invalid_protocols = apply_filters( 'wp_authorize_application_redirect_url_invalid_protocols', $bad_protocols, $url );
	$invalid_protocols = array_map( 'strtolower', $invalid_protocols );

	$scheme   = wp_parse_url( $url, PHP_URL_SCHEME );
	$host     = wp_parse_url( $url, PHP_URL_HOST );
	$is_local = 'local' === wp_get_environment_type();

	// Validates if the proper URI format is applied to the URL.
	if ( empty( $host ) || empty( $scheme ) || in_array( strtolower( $scheme ), $invalid_protocols, true ) ) {
		return new WP_Error(
			'invalid_redirect_url_format',
			__( 'Invalid URL format.' )
		);
	}

	if ( 'http' === $scheme && ! $is_local ) {
		return new WP_Error(
			'invalid_redirect_scheme',
			__( 'The URL must be served over a secure connection.' )
		);
	}

	return true;
}

View all references View on Trac View on GitHub