@@ -74,7 +74,7 @@ public function resolvedRemoteAddress(string $url): ?string
7474
7575 public function hasUnsafeNetworkTarget (string $ url ): bool
7676 {
77- $ parts = parse_url ($ url );
77+ $ parts = $ this -> parseUrl ($ url );
7878 $ host = is_array ($ parts ) && is_string ($ parts ['host ' ] ?? null ) ? strtolower ($ parts ['host ' ]) : '' ;
7979
8080 if ($ host === '' ) {
@@ -124,7 +124,7 @@ private function normalizeHttpUrl(mixed $url, bool $requireHttps): string
124124 return '' ;
125125 }
126126
127- $ parts = parse_url ($ url );
127+ $ parts = $ this -> parseUrl ($ url );
128128
129129 if (!is_array ($ parts )) {
130130 return '' ;
@@ -226,7 +226,7 @@ private function allowedOrigins(array $extraHosts): array
226226 /** @return array{scheme: string, host: string, port: int}|null */
227227 private function originParts (string $ url ): ?array
228228 {
229- $ parts = parse_url ($ url );
229+ $ parts = $ this -> parseUrl ($ url );
230230
231231 if (!is_array ($ parts )) {
232232 return null ;
@@ -361,8 +361,19 @@ private function isUnsafeIp(string $ip): bool
361361
362362 private function hostFromUrl (string $ url ): string
363363 {
364- $ parts = parse_url ($ url );
364+ $ parts = $ this -> parseUrl ($ url );
365365
366366 return is_array ($ parts ) && is_string ($ parts ['host ' ] ?? null ) ? strtolower ($ parts ['host ' ]) : '' ;
367367 }
368+
369+ /** @return array<string, mixed>|false */
370+ private function parseUrl (string $ url ): array |false
371+ {
372+ if (function_exists ('wp_parse_url ' )) {
373+ return wp_parse_url ($ url );
374+ }
375+
376+ // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Fallback when WordPress is not loaded.
377+ return parse_url ($ url );
378+ }
368379}
0 commit comments