[wp-trac] [WordPress Trac] #62355: WP sets REQUEST_URI to an invalid value if it's not set

WordPress Trac noreply at wordpress.org
Thu Nov 7 11:41:12 UTC 2024


#62355: WP sets REQUEST_URI to an invalid value if it's not set
--------------------------+-----------------------------
 Reporter:  kkmuffme      |      Owner:  (none)
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  General       |    Version:
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 https://github.com/WordPress/wordpress-develop/blame/trunk/src/wp-
 includes/load.php#L39

 This is invalid, since REQUEST_URI is always at least / and cannot be an
 empty string (you can test it, even for https://example.com it will be / -
 or read https://datatracker.ietf.org/doc/html/rfc3986, which shows it's
 possibly that it can be empty, but in that case PHP would not set the
 $_SERVER variable, therefore in context of PHP it's impossible it's an
 empty string for a valid request, unless someone incorrectly modifies it -
 like WP in this case)

 This issue propagates e.g. https://github.com/WordPress/wordpress-
 develop/blame/trunk/src/wp-includes/load.php#L72 which then means we have
 an impossible "?foo" for example as request URI.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/62355>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform


More information about the wp-trac mailing list