Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent URL in Link header from including invalid characters #1802

Merged
merged 11 commits into from
Feb 5, 2025
Merged

Prevent URL in Link header from including invalid characters #1802

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
700ec77
Optimize URL encoding logic in get_response_header
AhmarZaidi Jan 14, 2025
cd4116d
Merge branch 'trunk' into fix/optimization-detective-non-ascii-chars-…
westonruter Jan 29, 2025
d1c5afd
Upadate encoding logic to encode whole path
AhmarZaidi Jan 30, 2025
505c5bb
Add tests and update url encode scheme separately
AhmarZaidi Jan 31, 2025
50591ef
Encode only non ascii characters
AhmarZaidi Jan 31, 2025
8389a40
Update non-ascii matching logic & tests
AhmarZaidi Feb 3, 2025
ace40cb
Add test case for a responsive preload link without an href
westonruter Feb 3, 2025
b1ed4c1
Add failing test case for bare percent appearing in URL
westonruter Feb 3, 2025
7e8867f
Remove percentage from regex
AhmarZaidi Feb 4, 2025
2d14c6e
Merge branch 'trunk' into fix/optimization-detective-non-ascii-chars-…
westonruter Feb 4, 2025
c3c2512
Merge branch 'trunk' into fix/optimization-detective-non-ascii-chars-…
westonruter Feb 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions plugins/optimization-detective/class-od-link-collection.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,9 +255,24 @@ public function get_response_header(): ?string {
$link_headers = array();

foreach ( $this->get_prepared_links() as $link ) {
// The about:blank is present since a Link without a reference-uri is invalid so any imagesrcset would otherwise not get downloaded.
$link['href'] = isset( $link['href'] ) ? esc_url_raw( $link['href'] ) : 'about:blank';
$link_header = '<' . $link['href'] . '>';
if ( isset( $link['href'] ) ) {
$decoded_url = urldecode( $link['href'] );
AhmarZaidi marked this conversation as resolved.
Show resolved Hide resolved

// Encode characters not allowed in a URL per RFC 3986 (anything that is not among the reserved and unreserved characters).
$encoded_url = preg_replace_callback(
'/[^A-Za-z0-9\-._~:\/?#\[\]@!$&\'()*+,;=]/',
static function ( $matches ) {
return rawurlencode( $matches[0] );
},
$decoded_url
);
$link['href'] = esc_url_raw( $encoded_url ?? '' );
} else {
// The about:blank is present since a Link without a reference-uri is invalid so any imagesrcset would otherwise not get downloaded.
$link['href'] = 'about:blank';
}

$link_header = '<' . $link['href'] . '>';
unset( $link['href'] );
foreach ( $link as $name => $value ) {
/*
Expand Down
87 changes: 87 additions & 0 deletions plugins/optimization-detective/tests/test-class-od-link-collection.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,25 @@ public function data_provider_to_test_add_link(): array {
'expected_count' => 1,
'error' => '',
),
'preload_imagesrcset_without_href' => array(
'links_args' => array(
array(
array(
'rel' => 'preload',
'imagesrcset' => 'https://example.com/foo-400.jpg 400w, https://example.com/foo-800.jpg 800w',
'imagesizes' => '(max-width: 600px) 480px, 800px',
'as' => 'image',
'media' => 'screen',
),
),
),
'expected_html' => '
<link data-od-added-tag rel="preload" imagesrcset="https://example.com/foo-400.jpg 400w, https://example.com/foo-800.jpg 800w" imagesizes="(max-width: 600px) 480px, 800px" as="image" media="screen">
',
'expected_header' => 'Link: <about:blank>; rel="preload"; imagesrcset="https://example.com/foo-400.jpg 400w, https://example.com/foo-800.jpg 800w"; imagesizes="(max-width: 600px) 480px, 800px"; as="image"; media="screen"',
'expected_count' => 1,
'error' => '',
),
'preload_with_min0_max_viewport_widths' => array(
'links_args' => array(
array(
Expand Down Expand Up @@ -369,6 +388,74 @@ public function data_provider_to_test_add_link(): array {
'expected_count' => 0,
'error' => 'Maximum width must be greater than zero and greater than the minimum width.',
),
'international_domain_name' => array(
'links_args' => array(
array(
array(
'rel' => 'preload',
'href' => 'https://例.example.com/תמונה.jpg',
'as' => 'image',
),
),
),
'expected_html' => '
<link data-od-added-tag rel="preload" href="https://例.example.com/תמונה.jpg" as="image">
',
'expected_header' => 'Link: <https://%E4%BE%8B.example.com/%D7%AA%D7%9E%D7%95%D7%A0%D7%94.jpg>; rel="preload"; as="image"',
'expected_count' => 1,
'error' => '',
),
'non_ascii_path' => array(
'links_args' => array(
array(
array(
'rel' => 'preload',
'href' => 'https://example.com/חנות/תמונה.jpg',
'as' => 'image',
),
),
),
'expected_html' => '
<link data-od-added-tag rel="preload" href="https://example.com/חנות/תמונה.jpg" as="image">
',
'expected_header' => 'Link: <https://example.com/%D7%97%D7%A0%D7%95%D7%AA/%D7%AA%D7%9E%D7%95%D7%A0%D7%94.jpg>; rel="preload"; as="image"',
'expected_count' => 1,
'error' => '',
),
'percent-in-path' => array(
'links_args' => array(
array(
array(
'rel' => 'preload',
'href' => 'https://example.com/100%25-one-hundred-percent.png?a[1]=2',
'as' => 'image',
),
),
),
'expected_html' => '
<link data-od-added-tag rel="preload" href="https://example.com/100%25-one-hundred-percent.png?a[1]=2" as="image">
',
'expected_header' => 'Link: <https://example.com/100%25-one-hundred-percent.png?a%5B1%5D=2>; rel="preload"; as="image"',
'expected_count' => 1,
'error' => '',
),
'multisite_subdirectory_non_ascii' => array(
'links_args' => array(
array(
array(
'rel' => 'preload',
'href' => 'https://example.com/חנות/wp-content/uploads/2025/01/example.jpg?ver=1+2',
'as' => 'image',
),
),
),
'expected_html' => '
<link data-od-added-tag rel="preload" href="https://example.com/חנות/wp-content/uploads/2025/01/example.jpg?ver=1+2" as="image">
',
'expected_header' => 'Link: <https://example.com/%D7%97%D7%A0%D7%95%D7%AA/wp-content/uploads/2025/01/example.jpg?ver=1%202>; rel="preload"; as="image"',
'expected_count' => 1,
'error' => '',
),
);
}

Expand Down
Loading