| @@ -1584,8 +1584,16 @@ | ||
| 1584 | 1584 | if ( empty( $url_components['host'] ) ) { |
| 1585 | 1585 | return false; |
| 1586 | 1586 | } |
| 1587 | 1587 | |
| 1588 | + // Only http and https URLs are valid. | |
| 1589 | + if ( | |
| 1590 | + isset( $url_components['scheme'] ) | |
| 1591 | + && ! in_array( strtolower( $url_components['scheme'] ), array( 'http', 'https' ), true ) | |
| 1592 | + ) { | |
| 1593 | + return false; | |
| 1594 | + } | |
| 1595 | + | |
| 1588 | 1596 | // Normalize URL. |
| 1589 | 1597 | $url = sprintf( |
| 1590 | 1598 | '%s://%s%s%s', |
| 1591 | 1599 | $url_components['scheme'] ?? 'https', |
