Appliance inithooks - check for doubled-up domain/base url

[JedMeister]

It has been reported on the forums that it can relatively easily break the WordPress appliance by setting a domain that includes a doubled up schema. E.g. https://http://example.com. We already do some domain/url validation but an explicit check for this scenario should be included.

This report was explicitly related to our WordPress appliance, but I imagine that it may be relevant to other appliances too.

[JedMeister]

Hey @OnGle I just noticed this bug reported on the forums. Could you please have a look?

Just addressing this in WordPress is acceptable for now IMO but perhaps it's worth taking the "fix" a step further?

IIRC the way it is currently is that each app that requires a domain/url has it's own validation code in the specific app specific inithook?

Perhaps now is a good time to provide a broader consistent fix via a parsing/validation library in the inithooks package? That could be imported by each appliance specific inithook?

If we go that way we will need to be able to parse/validate both FQDN & base URL (domain with schema). E.g. support both www.example.com & https://www.example.com.

Also we've discussed offline, the current situation is not ideal as different inithooks use the term "domain" to describe both FQDN (no schema) & base URL (with schema). IMO if we go ahead with a library, we should be able to have different functions for the 2 different ones (even if they have some "hidden" shared code within the library.

I'm happy to discuss further offline if you'd like but I'll happy to leave the specific implementation to you.