[wp-trac] [WordPress Trac] #64170: gethostbyname() in validating URLs does not work for IPv6

[WordPress Trac]

#64170: gethostbyname() in validating URLs does not work for IPv6
------------------------------+-----------------------------
 Reporter:  frankieandshadow  |      Owner:  (none)
     Type:  defect (bug)      |     Status:  new
 Priority:  normal            |  Milestone:  Awaiting Review
Component:  Plugins           |    Version:  6.8.3
 Severity:  normal            |   Keywords:
  Focuses:                    |
------------------------------+-----------------------------
 Summary:

 wp_http_validate_url() rejects valid URLs when the hostname resolves to
 IPv6-only addresses, because gethostbyname() only supports IPv4. I
 discovered this with a custom plugin repository in a IPv6 only network (so
 the DNS only has a AAAA record when it validates the URL provided to fetch
 the plugin package).

 Expected behavior:
 URLs with hostnames that resolve to IPv6 addresses should be validated
 successfully.

 Actual behavior:
 When a hostname resolves only to IPv6, gethostbyname() returns the
 hostname unchanged, which the function treats as a DNS lookup failure and
 rejects the URL.

 How to reproduce:
 Create a hostname that resolves only to IPv6 (AAAA record, no A record)
 Try to use that URL in any WordPress HTTP API call with default settings
 The URL will be rejected with "A valid URL was not provided"

 Suggested fix:
 Replace gethostbyname() with dns_get_record() or similar that supports
 both IPv4 and IPv6 (or use getaddrinfo() via a PHP extension.

 Workaround:
 Set reject_unsafe_urls to false in http_request_args filter for affected
 URLs.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/64170>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform