Adds wp_http_normalize_url() to rewrite webcal/webcals to https befor…

[yashyadav-mo]

webcal:// and webcals:// URLs are allowed in HTML via wp_allowed_protocols() (#31666), but the HTTP API still rejects them. wp_remote_get() and wp_safe_remote_get() fail with WP_Error: A valid URL was not provided. because wp_kses_bad_protocol() only permits http/https (and ssl in WP_Http::request()), and HTTP transports only support http/https.

This change:

wp_http_normalize_url() — Rewrites webcal:// and webcals:// to https:// (case-insensitive) before validation and transport. Exposes the http_normalize_url filter so sites that serve calendars over plain HTTP can map to http:// if needed.

wp_http_validate_url() — Validates the normalized URL (SSRF checks run against the real https:// target) but returns the original URL when safe, so callers can keep storing/displaying webcal:// links.

http_allowed_protocols filter — Lets plugins extend allowed schemes in validation/wp_kses_bad_protocol() at their own risk. Documented that transports still only execute http/https; webcal is intentionally not added to the default list because normalization handles it without accepting raw webcal:// in the transport path.

WP_Http::request() — Normalizes the URL immediately after pre_http_request, before kses and wp_http_validate_url().

Trac ticket: https://core.trac.wordpress.org/ticket/49385

Use of AI Tools
AI assistance: Yes
Tool(s): Cursor (Auto)
Used for: Implementation plan, code changes, unit tests, and this PR description; changes were reviewed against the Trac ticket and existing HTTP API patterns.

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

Test plan

vendor/bin/phpunit tests/phpunit/tests/http/http.php --filter 49385 (or npm run test:php -- --filter 49385 tests/phpunit/tests/http/http.php)

Confirm wp_http_normalize_url( 'webcal://example.com/feed.ics' ) returns https://example.com/feed.ics

Confirm wp_http_validate_url( 'webcal://example.com/caniload.php' ) returns the original webcal:// URL

Confirm wp_http_validate_url( 'ftp://example.com/caniload.php' ) still returns false

Confirm wp_remote_get( 'webcal://example.com/feed.ics' ) no longer returns A valid URL was not provided. (outbound request uses https://)

Confirm wp_safe_remote_get( 'webcal://example.com/feed.ics' ) passes validation and fetches over HTTPS

Run broader HTTP API tests: phpunit --group http

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @root@MO-LT-1110.ad.xecurify.com.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

Core Committers: Use this line as a base for the props when committing in SVN:

Props yashyadav247.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.