check_url function now creates unusable urls when module adds a query string

Hi!

I have also found this problem with 4.6.4. It is because htmlspecialchars is executed twice so a single ampersand (as added by the function url()) gets transformed into & by check_url(), and transformed into & at the end of the new function filter_xss_bad_protocol() (added to filter.module).

See for yourself:

function check_url($uri) {
  $uri = htmlspecialchars($uri, ENT_QUOTES);
  $uri = filter_xss_bad_protocol($uri, FALSE);

  return $uri;
}

function filter_xss_bad_protocol($string, $decode = TRUE) {
  // Get the plain text representation of the attribute value (i.e. its meaning)
  if ($decode) {
    $string = decode_entities($string);
  }
  // Remove soft hyphen
  $string = str_replace(chr(194) . chr(173), '', $string);
  $string2 = '';
  // Strip protocols
  do {
    $before = $string;
    $string = preg_replace_callback('/^([^:]+):/', '_filter_xss_bad_protocol', $string);
  } while ($before != $string);
  return check_plain($string);
}

Note filter_xss_bad_protocol calls check_plain, which looks like this (in bootstrap.inc):

function check_plain($text) {
  return htmlspecialchars($text, ENT_QUOTES);
}

I believe it's probably wise now to simplify the function check_url() like this:

function check_url($uri) {
  $uri = filter_xss_bad_protocol($uri, FALSE);

  return $uri;
}

But that prolly depends on where the drupal devs wanted to go with the new changes.

Just seen this reported and fixed here:
http://drupal.org/node/39566

:cool:

for core 5.x & 6.x #119025: l() appends the querystring with modified ampersand symbols