line 1360 or so

  do {                                                                              
    $before = $string;                                                          
    $colonpos = strpos($string, ':');                                          
    if ($colonpos > 0) {                                                        
      $protocol = substr($string, 0, $colonpos);                                
      if (!isset($allowed_protocols[$protocol])) {                              
        $string = substr($string, $colonpos + 1);                                     
      }                                                                             
    }                                                                             
  } while ($before != $string);

if string is of form /http://url:port/blah/blah then it fouls it up by removing the entire url rather than just the protocol which breaks things, such as displaying user pictures in profiles.

Possible patch: on mine I tried changing 

    $colonpos = strpos($string, ':');

to 

    $colonpos = strpos($string, ':/');

which makes it work again but I'm not sure that's the best way to do it.

Comments

Steven’s picture

Steven commented
Status: Active » Closed (won't fix)

Port numbers work fine, provided the protocol that was specified was valid in the first place. I'm not sure if it was a typo or not, but your URL started with /http:// rather than http://. If I pass URLs such as http://test.com:80/ through filter_xss_bad_protocol(), they come out unharmed.

tunesmith’s picture

tunesmith commented

hrm... I don't think it was a typo. That's the form of the url that drupal saw when I printed out the debug output. I'm not the only person that's happened to, either... I am not sure what could be causing it to prepend that preceding slash.