| @@ -609,11 +609,10 @@ | ||
| 609 | 609 | public function validate_sitemap(WP_REST_Request $request) { |
| 610 | 610 | try { |
| 611 | 611 | $sitemap_url = $request->get_param('sitemap_url') ?? home_url('/sitemap.xml'); |
| 612 | 612 | |
| 613 | - // Validate sitemap URL. Url_Validator accepts an internationalised | |
| 614 | - // domain or a non-ASCII path (home_url() on an IDN site is one). | |
| 615 | - if (!\ThinkRank\Core\Url_Validator::is_valid($sitemap_url)) { | |
| 613 | + // Validate sitemap URL | |
| 614 | + if (!filter_var($sitemap_url, FILTER_VALIDATE_URL)) { | |
| 616 | 615 | return new WP_Error( |
| 617 | 616 | 'invalid_url', |
| 618 | 617 | 'Invalid sitemap URL provided', |
| 619 | 618 | ['status' => 400] |
| @@ -618,14 +617,8 @@ | ||
| 618 | 617 | 'Invalid sitemap URL provided', |
| 619 | 618 | ['status' => 400] |
| 620 | 619 | ); |
| 621 | 620 | } |
| 622 | - | |
| 623 | - // Everything from here on works on the ASCII form (punycode host, | |
| 624 | - // percent-encoded path). wp_http_validate_url() resolves the host | |
| 625 | - // with gethostbyname(), which cannot resolve a Unicode name, and | |
| 626 | - // the SSRF check must see exactly the URL that is fetched. | |
| 627 | - $sitemap_url = \ThinkRank\Core\Url_Validator::to_ascii((string) $sitemap_url); | |
| 628 | 621 | |
| 629 | 622 | // Block SSRF: this endpoint fetches the URL server-side, so reject |
| 630 | 623 | // loopback/link-local/private hosts and non-http(s) schemes via |
| 631 | 624 | // WordPress's own validator (same guard used in class-schema-endpoint). |
