(bug 27854) Http::isValidURI is way to lax. This is a much simplified regex that...

regex, but also accepts ftps because both cURL and php support it. It no longer accepts thing like 'foo http://bar bax'
which was my main concern

Note the previous regex kind of looks more restrictive, but is not since saying "anything not containing a space
optionally followed by anything not containing a bunch of characters including a space" is the same as saying anything
with no spaces. See also r83296. This obviously doesn't catch all cases, but I personally think its sufficient.
At the very least it is a very significant improvement over the previous version that caught almost nothing.

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index a60248d..aeeb169 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -161,6 +161,7 @@ PHP if you have not done so prior to upgrading MediaWiki.
   incorrect revision ID is passed.
 * Trim the form field for uploading by url to remove extra spaces which could
   cause confusing error messages.
+* (bug 27854) Http::isValidURI is way too lax.
 
 === API changes in 1.18 ===
 * (bug 26339) Throw warning when truncating an overlarge API result

diff --git a/includes/HttpFunctions.php b/includes/HttpFunctions.php
index 3b08cfd..8db3e4f 100644 (file)
--- a/includes/HttpFunctions.php
+++ b/includes/HttpFunctions.php
@@ -117,16 +117,17 @@ class Http {
        }
 
        /**
-        * Checks that the given URI is a valid one
+        * Checks that the given URI is a valid one. Hardcoding the
+        * protocols, because we only want protocols that both cURL
+        * and php support.
         *
         * @param $uri Mixed: URI to check for validity
         * @returns Boolean
         */
        public static function isValidURI( $uri ) {
                return preg_match(
-                       '/(ftp|http|https):\/\/(\w+:{0,1}\w*@)?(\S+)(:[0-9]+)?(\/|\/([\w#!:.?+=&%@!\-\/]))?/',
-                       $uri,
-                       $matches
+                       '/^(f|ht)tps?:\/\/[^\/\s]\S*$/D',
+                       $uri
                );
        }
 }