wp_validate_redirect( string $location, string $fallback_url = '' ): string

1665	function wp_validate_redirect( $location, $fallback_url = '' ) {1666		$location = wp_sanitize_redirect( trim( $location, " \t\n\r\0\x08\x0B" ) );1667		// Browsers will assume 'http' is your protocol, and will obey a redirect to a URL starting with '//'.1668		if ( str_starts_with( $location, '//' ) ) {1669			$location = 'http:' . $location;1670		}1671 1672		/*1673		 * In PHP 5 parse_url() may fail if the URL query part contains 'http://'.1674		 * See https://bugs.php.net/bug.php?id=381431675		 */1676		$cut  = strpos( $location, '?' );1677		$test = $cut ? substr( $location, 0, $cut ) : $location;1678 1679		$lp = parse_url( $test );1680 1681		// Give up if malformed URL.1682		if ( false === $lp ) {1683			return $fallback_url;1684		}1685 1686		// Allow only 'http' and 'https' schemes. No 'data:', etc.1687		if ( isset( $lp['scheme'] ) && ! ( 'http' === $lp['scheme'] || 'https' === $lp['scheme'] ) ) {1688			return $fallback_url;1689		}1690 1691		if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {1692			$path = '';1693			if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {1694				$path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );1695				$path = wp_normalize_path( $path );1696			}1697			$location = '/' . ltrim( $path . '/', '/' ) . $location;1698		}1699 1700		/*1701		 * Reject if certain components are set but host is not.1702		 * This catches URLs like https:host.com for which parse_url() does not set the host field.1703		 */1704		if ( ! isset( $lp['host'] ) && ( isset( $lp['scheme'] ) || isset( $lp['user'] ) || isset( $lp['pass'] ) || isset( $lp['port'] ) ) ) {1705			return $fallback_url;1706		}1707 1708		// Reject malformed components parse_url() can return on odd inputs.1709		foreach ( array( 'user', 'pass', 'host' ) as $component ) {1710			if ( isset( $lp[ $component ] ) && strpbrk( $lp[ $component ], ':/?#@' ) ) {1711				return $fallback_url;1712			}1713		}1714 1715		$wpp = parse_url( home_url() );1716 1717		/**1718		 * Filters the list of allowed hosts to redirect to.1719		 *1720		 * @since 2.3.01721		 *1722		 * @param string[] $hosts An array of allowed host names.1723		 * @param string   $host  The host name of the redirect destination; empty string if not set.1724		 */1725		$allowed_hosts = (array) apply_filters( 'allowed_redirect_hosts', array( $wpp['host'] ), $lp['host'] ?? '' );1726 1727		if ( isset( $lp['host'] ) && ( ! in_array( $lp['host'], $allowed_hosts, true ) && strtolower( $wpp['host'] ) !== $lp['host'] ) ) {1728			$location = $fallback_url;1729		}1730 1731		return $location;1732	}