<?php
/**
* Trait WordPress\Plugin_Check\Traits\URL_Utils
*
* @package plugin-check
*/
namespace WordPress\Plugin_Check\Traits;
/**
* Trait for URL utilities.
*
* @since 1.6.0
*/
trait URL_Utils {
/**
* Checks if URL is valid.
*
* @since 1.6.0
*
* @param string $url URL.
* @return bool true if the URL is valid, otherwise false.
*/
protected function is_valid_url( string $url ): bool {
// Must start with http or https.
if ( ! str_starts_with( $url, 'http' ) ) {
return false;
}
// Parse the URL to validate its structure.
$parsed_url = wp_parse_url( $url );
// wp_parse_url returns false on parse failure.
if ( false === $parsed_url || ! is_array( $parsed_url ) ) {
return false;
}
// Must have a valid scheme and host.
if ( empty( $parsed_url['scheme'] ) || empty( $parsed_url['host'] ) ) {
return false;
}
// Validate host doesn't contain obviously invalid characters.
// Allow alphanumeric, dots, hyphens, and underscores (for localhost, etc.).
if ( preg_match( '/[^a-z0-9.\-_]/i', $parsed_url['host'] ) ) {
return false;
}
// Detect duplicated protocol in the host/path portion (e.g., "https://http://example.com/").
// Only check up to the query string to avoid false positives with URLs in query parameters.
$query_position = strpos( $url, '?' );
if ( false !== $query_position ) {
$url_without_query = substr( $url, 0, $query_position );
} else {
$url_without_query = $url;
}
// Check for duplicated protocol after the scheme:// portion.
$scheme_length = strlen( $parsed_url['scheme'] );
$after_scheme = substr( $url_without_query, $scheme_length + 3 );
if ( str_contains( $after_scheme, '://' ) ) {
return false;
}
return true;
}
/**
* Finds and returns the discouraged domain matched in the URL's host, or null if none.
*
* @since 1.6.0
*
* @param string $url The URL to check.
* @return string|null The matched discouraged domain, or null if none matched.
*/
protected function find_discouraged_domain( string $url ) {
$discouraged_domains = $this->get_discouraged_domains();
if ( empty( $discouraged_domains ) ) {
return null;
}
$parsed_url = wp_parse_url( $url );
if ( empty( $parsed_url['host'] ) ) {
return null;
}
$host = strtolower( rtrim( $parsed_url['host'], '.' ) );
foreach ( $discouraged_domains as $domain ) {
$domain = strtolower( rtrim( $domain, '.' ) );
if (
$host === $domain ||
( strlen( $host ) > strlen( $domain ) && substr( $host, -strlen( $domain ) - 1 ) === '.' . $domain )
) {
return $domain;
}
}
return null;
}
/**
* Checks if URL has discouraged domain.
*
* @since 1.6.0
*
* @param string $url The URL to check.
* @return bool True if the URL has a discouraged domain, false otherwise.
*/
protected function has_discouraged_domain( $url ) {
return null !== $this->find_discouraged_domain( $url );
}
/**
* Returns discouraged domains.
*
* @since 1.6.0
*
* @return array Discouraged domains.
*/
private function get_discouraged_domains() {
$discouraged_domains = array(
'example.com',
'example.net',
'example.org',
'yourdomain.com',
'yourwebsite.com',
);
/**
* Filter the list of discouraged domains.
*
* @since 1.6.0
*
* @param array $discouraged_domains Array of discouraged domains.
*/
$discouraged_domains = (array) apply_filters( 'wp_plugin_check_discouraged_domains', $discouraged_domains );
return $discouraged_domains;
}
}