[wp-trac] [WordPress Trac] #64457: Early filter invalid hosts in wp_http_validate_url

WordPress Trac noreply at wordpress.org
Thu Jan 1 23:10:41 UTC 2026


#64457: Early filter invalid hosts in wp_http_validate_url
-------------------------+-----------------------------
 Reporter:  SirLouen     |       Owner:  (none)
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  Future Release
Component:  HTTP API     |     Version:
 Severity:  normal       |  Resolution:
 Keywords:  needs-patch  |     Focuses:  performance
-------------------------+-----------------------------

Comment (by SirLouen):

 > My point is that the practical often differs from the theoretical, as is
 the case for DNS resolution. In its current form wp_http_validate_url()
 handles sub-domains with underscores and that will need to be the case in
 the future.

 Trying to create a blogspot account now with an underscore.

 [[Image(https://i.imgur.com/eJYlGo3.png)]]

 It appears that Google has evolved.

 Luckily, @peterwilsoncc ha a vast memory to recall one of those in ten
 million cases.

 Still, if we would like to play with Jurassic Park rules and avoid the
 T-Rex could escape from the enclosure, we could stick just to the domain,
 schema and tld part, because, in reality is the only thing that is
 sticking to the real RFC rulings (from there any kind of subdomain
 sublevel could be technically the jungle).

 So (take notes for unit tests):

 1. `h_ttp://example.org` should be invalid
 2. hey_ho_lets_go._example.org should be invalid
 3. omg.c_om should be invalid
 4. peter_is_amazing.example.org should be VALID

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/64457#comment:18>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform


More information about the wp-trac mailing list