wp_http_validate_url( string $url ): string|false

552function wp_http_validate_url( $url ) {553	if ( ! is_string( $url ) || '' === $url || is_numeric( $url ) ) {554		return false;555	}556 557	$original_url = $url;558	$url          = wp_kses_bad_protocol( $url, array( 'http', 'https' ) );559	if ( ! $url || strtolower( $url ) !== strtolower( $original_url ) ) {560		return false;561	}562 563	$parsed_url = parse_url( $url );564	if ( ! $parsed_url || empty( $parsed_url['host'] ) ) {565		return false;566	}567 568	if ( isset( $parsed_url['user'] ) || isset( $parsed_url['pass'] ) ) {569		return false;570	}571 572	if ( false !== strpbrk( $parsed_url['host'], ':#?[]' ) ) {573		return false;574	}575 576	$parsed_home = parse_url( get_option( 'home' ) );577	$same_host   = isset( $parsed_home['host'] ) && strtolower( $parsed_home['host'] ) === strtolower( $parsed_url['host'] );578	$host        = trim( $parsed_url['host'], '.' );579 580	if ( ! $same_host ) {581		if ( preg_match( '#^(([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)\.){3}([1-9]?\d|1\d\d|25[0-5]|2[0-4]\d)$#', $host ) ) {582			$ip = $host;583		} else {584			$ip = gethostbyname( $host );585			if ( $ip === $host ) { // Error condition for gethostbyname().586				return false;587			}588		}589		if ( $ip ) {590			$parts = array_map( 'intval', explode( '.', $ip ) );591 592			/*593			 * These IP address ranges are not considered valid external hosts for HTTP requests.594			 *595			 * If the host resolves to an IP address in these ranges, the request will be rejected unless the 'http_request_host_is_external' filter allows it.596			 *597			 * References:598			 *599			 * - IPv4 Special-Purpose Address Space: https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml600			 * - IPv4 Multicast Address Assignments: https://www.rfc-editor.org/rfc/rfc5771.html601			 */602			if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]          // 127.0.0.0/8 (loopback), 10.0.0.0/8 (private), 0.0.0.0/8 (this network).603				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )     // 172.16.0.0/12 (private).604				|| ( 192 === $parts[0] && 168 === $parts[1] )                      // 192.168.0.0/16 (private).605				|| ( 192 === $parts[0] && 0 === $parts[1] && 0 === $parts[2] )     // 192.0.0.0/24 (IETF protocol assignments).606				|| ( 192 === $parts[0] && 0 === $parts[1] && 2 === $parts[2] )     // 192.0.2.0/24 (TEST-NET-1).607				|| ( 192 === $parts[0] && 88 === $parts[1] && 99 === $parts[2] )   // 192.88.99.0/24 (6to4 relay anycast).608				|| ( 198 === $parts[0] && 51 === $parts[1] && 100 === $parts[2] )  // 198.51.100.0/24 (TEST-NET-2).609				|| ( 203 === $parts[0] && 0 === $parts[1] && 113 === $parts[2] )   // 203.0.113.0/24 (TEST-NET-3).610				|| ( 169 === $parts[0] && 254 === $parts[1] )                      // 169.254.0.0/16 (link-local and cloud metadata).611				|| ( 100 === $parts[0] && 64 <= $parts[1] && 127 >= $parts[1] )    // 100.64.0.0/10 (CGNAT).612				|| ( 198 === $parts[0] && 18 <= $parts[1] && 19 >= $parts[1] )     // 198.18.0.0/15 (benchmarking).613				|| ( 224 <= $parts[0] && 239 >= $parts[0] )                        // 224.0.0.0/4 (multicast).614				|| 240 <= $parts[0]                                                // 240.0.0.0/4 (reserved, includes 255.255.255.255 broadcast).615			) {616				// If host appears local, reject unless specifically allowed.617				/**618				 * Checks if HTTP request is external or not.619				 *620				 * Allows to change and allow external requests for the HTTP request.621				 *622				 * @since 3.6.0623				 *624				 * @param bool   $external Whether HTTP request is external or not.625				 * @param string $host     Host name of the requested URL.626				 * @param string $url      Requested URL.627				 */628				if ( ! apply_filters( 'http_request_host_is_external', false, $host, $url ) ) {629					return false;630				}631			}