diff --git a/php/class-delivery.php b/php/class-delivery.php index ec0c577d..93fd3b91 100644 --- a/php/class-delivery.php +++ b/php/class-delivery.php @@ -1566,7 +1566,10 @@ public function parse_element( $element, $content = '' ) { return null; } - $raw_url = 'source' === $tag_element['tag'] && ! empty( $attributes['srcset'] ) ? $attributes['srcset'] : $attributes['src']; + $raw_url = 'source' === $tag_element['tag'] && ! empty( $attributes['srcset'] ) ? $attributes['srcset'] : ( $attributes['src'] ?? '' ); + if ( '' === $raw_url ) { + return null; + } $url = $this->maybe_unsize_url( Utils::clean_url( $this->sanitize_url( $raw_url ) ) ); $tag_element['base_url'] = $url; // Track back the found URL. @@ -1943,6 +1946,11 @@ protected function set_usability( $item, $auto_sync = null ) { */ protected function sanitize_url( $url ) { + // Bail early on empty or non-string URLs. + if ( ! is_string( $url ) || '' === $url ) { + return null; + } + // Catch mixed URLs. if ( 5 < strlen( $url ) && false !== strpos( $url, 'https://', 5 ) ) { $url = substr( $url, strpos( $url, 'https://', 5 ) );