CleanTalk · svfcode · Aug 10, 2026 · Aug 6, 2026 · Aug 7, 2026
diff --git a/lib/Cleantalk/Antispam/Integrations/CleantalkExternalForms.php b/lib/Cleantalk/Antispam/Integrations/CleantalkExternalForms.php
@@ -4,6 +4,7 @@
 
 use Cleantalk\ApbctWP\Variables\Post;
 use Cleantalk\ApbctWP\Escape;
+use Cleantalk\ApbctWP\Validate;
 
 class CleantalkExternalForms extends IntegrationBase
 {
@@ -14,8 +15,15 @@ public function doPrepareActions($argument)
     {
         if ( empty($_POST)
             || !apbct_is_post()
-            || Post::get('cleantalk_hidden_method') === ''
-            || Post::get('cleantalk_hidden_action') === ''
+            || Post::getString('cleantalk_hidden_method') === ''
+            || Post::getString('cleantalk_hidden_action') === ''
+        ) {
+            return false;
+        }
+
+        // Reject non-http(s) actions early (e.g. javascript:/data:) before any output.
+        if ( ! $this->isAllowedExternalFormAction(Post::getString('cleantalk_hidden_action'))
+            || ! $this->isAllowedExternalFormMethod(Post::getString('cleantalk_hidden_method'))
         ) {
             return false;
         }
@@ -27,11 +35,27 @@ public function getDataForChecking($argument)
     {
         if ( ! empty($_POST)
             && apbct_is_post()
-            && Post::get('cleantalk_hidden_method') !== ''
-            && Post::get('cleantalk_hidden_action') !== ''
+            && Post::getString('cleantalk_hidden_method') !== ''
+            && Post::getString('cleantalk_hidden_action') !== ''
         ) {
-            $this->action = Escape::escHtml(Post::get('cleantalk_hidden_action'));
-            $this->method = Escape::escHtml(Post::get('cleantalk_hidden_method'));
+            $action = Post::getString('cleantalk_hidden_action');
+            $method = Post::getString('cleantalk_hidden_method');
+
+            if ( ! $this->isAllowedExternalFormAction($action)
+                || ! $this->isAllowedExternalFormMethod($method)
+            ) {
+                return null;
+            }
+
+            // Keep a sanitized raw URL; escape for HTML only when rendering the form.
+            // HTML escaping alone does not block javascript: URLs in action attributes.
+            $this->action = Escape::escUrlRaw($action);
+            $this->method = strtoupper($method);
+
+            if ( empty($this->action) ) {
+                return null;
+            }
+
             unset($_POST['cleantalk_hidden_action'], $_POST['cleantalk_hidden_method']);
 
             /**
@@ -111,6 +135,22 @@ private function constructFormInnerElements($arr, $recursive_key)
 
     private function constructOriginExternalForm($action, $method)
     {
+        if ( empty($action)
+            || empty($method)
+            || ! $this->isAllowedExternalFormAction($action)
+            || ! $this->isAllowedExternalFormMethod($method)
+        ) {
+            return '';
+        }
+
+        // Restrict protocols at output: only http/https are allowed in form action.
+        $action = esc_url($action, array('http', 'https'));
+        $method = Escape::escHtml(strtoupper($method));
+
+        if ( empty($action) ) {
+            return '';
+        }
+
         // HTML form template
         $form_template = '
         <html lang="">
@@ -153,4 +193,30 @@ private function constructOriginExternalForm($action, $method)
 
         return $form_template;
     }
+
+    /**
+     * External form action must be an absolute http/https URL.
+     * javascript:, data:, vbscript: and other schemes are rejected.
+     *
+     * @param mixed $action
+     *
+     * @return bool
+     */
+    private function isAllowedExternalFormAction($action)
+    {
+        return is_string($action) && Validate::isUrl($action);
+    }
+
+    /**
+     * HTML form method may only be GET or POST.
+     *
+     * @param mixed $method
+     *
+     * @return bool
+     */
+    private function isAllowedExternalFormMethod($method)
+    {
+        return is_string($method)
+            && in_array(strtolower($method), array('get', 'post'), true);
+    }
 }
diff --git a/lib/Cleantalk/Common/Validate.php b/lib/Cleantalk/Common/Validate.php
@@ -82,8 +82,16 @@ public static function isValidFilePath($variable)
 
     public static function isUrl($url)
     {
-        return ( strpos($url, 'http://') !== false || strpos($url, 'https://') !== false ) &&
-               filter_var($url, FILTER_VALIDATE_URL);
+        if ( ! is_string($url) || $url === '' ) {
+            return false;
+        }
+
+        $scheme = strtolower((string) parse_url($url, PHP_URL_SCHEME));
+
+        // Allow only http/https. Checking the scheme prevents javascript:/data: bypasses
+        // that embed "http://" or "https://" in the rest of the string.
+        return in_array($scheme, array('http', 'https'), true) &&
+               (bool) filter_var($url, FILTER_VALIDATE_URL);
     }
 
     /**

diff --git a/tests/Antispam/IntegrationsByHook/TestCleantalkExternalForms.php b/tests/Antispam/IntegrationsByHook/TestCleantalkExternalForms.php
@@ -0,0 +1,106 @@
+<?php
+
+use Cleantalk\ApbctWP\Variables\Post;
+use Cleantalk\ApbctWP\Variables\Server;
+use Cleantalk\Antispam\Integrations\CleantalkExternalForms;
+use PHPUnit\Framework\TestCase;
+
+class TestCleantalkExternalForms extends TestCase
+{
+    /**
+     * @var CleantalkExternalForms
+     */
+    private $integration;
+
+    /**
+     * @var array
+     */
+    private $post_global;
+
+    /**
+     * @var array
+     */
+    private $server_global;
+
+    protected function setUp(): void
+    {
+        $this->integration = new CleantalkExternalForms();
+        $this->post_global = $_POST;
+        $this->server_global = $_SERVER;
+        $_SERVER['REQUEST_METHOD'] = 'POST';
+        $this->resetVariableCaches();
+    }
+
+    protected function tearDown(): void
+    {
+        $_POST = $this->post_global;
+        $_SERVER = $this->server_global;
+        $this->resetVariableCaches();
+    }
+
+    private function resetVariableCaches()
+    {
+        Post::getInstance()->variables = [];
+        Server::getInstance()->variables = [];
+    }
+
+    public function testDoPrepareActionsRejectsJavascriptAction()
+    {
+        $_POST = array(
+            'cleantalk_hidden_method' => 'POST',
+            'cleantalk_hidden_action' => 'javascript:alert(String.fromCharCode(80,83,67,45,88,83,83));void 0',
+        );
+        $this->resetVariableCaches();
+
+        $this->assertFalse($this->integration->doPrepareActions(null));
+    }
+
+    public function testDoPrepareActionsRejectsJavascriptHttpsBypass()
+    {
+        $_POST = array(
+            'cleantalk_hidden_method' => 'POST',
+            'cleantalk_hidden_action' => 'javascript://https://evil.com%0aalert(1)',
+        );
+        $this->resetVariableCaches();
+
+        $this->assertFalse($this->integration->doPrepareActions(null));
+    }
+
+    public function testDoPrepareActionsRejectsDataUri()
+    {
+        $_POST = array(
+            'cleantalk_hidden_method' => 'POST',
+            'cleantalk_hidden_action' => 'data:text/html,<script>alert(1)</script>',
+        );
+        $this->resetVariableCaches();
+
+        $this->assertFalse($this->integration->doPrepareActions(null));
+    }
+
+    public function testDoPrepareActionsRejectsInvalidMethod()
+    {
+        $_POST = array(
+            'cleantalk_hidden_method' => 'PUT',
+            'cleantalk_hidden_action' => 'https://example.com/form',
+        );
+        $this->resetVariableCaches();
+
+        $this->assertFalse($this->integration->doPrepareActions(null));
+    }
+
+    public function testDoPrepareActionsAllowsHttpHttps()
+    {
+        $_POST = array(
+            'cleantalk_hidden_method' => 'POST',
+            'cleantalk_hidden_action' => 'https://example.com/form',
+        );
+        $this->resetVariableCaches();
+
+        $this->assertTrue($this->integration->doPrepareActions(null));
+
+        $_POST['cleantalk_hidden_action'] = 'http://45.137.81.184/';
+        $this->resetVariableCaches();
+
+        $this->assertTrue($this->integration->doPrepareActions(null));
+    }
+}
diff --git a/tests/ApbctWP/ValidateTest.php b/tests/ApbctWP/ValidateTest.php
@@ -19,5 +19,12 @@ public function testIsUrl()
         $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('https://cleantalk.org/some-path/with_parameter=😭'));
         $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('ftp://cleantalk.org'));
         $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('cleantalk.org'));
+        $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('javascript:alert(1)'));
+        $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('javascript:alert(String.fromCharCode(80,83,67,45,88,83,83));void 0'));
+        $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('javascript://https://evil.com%0aalert(1)'));
+        $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl("javascript:alert('http://x')"));
+        $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('data:text/html,<script>alert(1)</script>'));
+        $this->assertFalse(\Cleantalk\ApbctWP\Validate::isUrl('vbscript:msgbox(1)'));
+        $this->assertTrue(\Cleantalk\ApbctWP\Validate::isUrl('http://45.137.81.184/'));
     }
 }
diff --git a/tests/Common/HelperTest.php b/tests/Common/HelperTest.php
@@ -12,9 +12,20 @@ public function test_http__multi_request_error() {
 	    $this->assertArrayHasKey( 'error', Helper::httpMultiRequest( array(array('https://google.com')) ) );
     }
 
+	/**
+	 * @group integration
+	 */
 	public function test_http__multi_request_success() {
     	$res = Helper::httpMultiRequest( array('https://google.com', 'https://apple.com') );
 		$this->assertIsArray( $res );
+
+		// Outbound HTTP may fail in some environments (firewall/DNS/proxy).
+		foreach ( $res as $body ) {
+			if ( ! is_string($body) ) {
+				$this->markTestSkipped('Outbound HTTP multi-request not available in this environment');
+			}
+		}
+
 		$this->assertContainsOnly( 'string', $res );
 	}