Cms: UrlHelper::siteUrl should only ever output…site URLs.

[timkelty]

If you pass UrlHelper::siteUrl an absolute url, eg, UrlHelper::siteUrl('https://a-malicious-link-here.com'), it will return that URL, which is not a site url.

That seems misleading, I don't think it should (I think that logic should _only_ be in UrlHelper::url).

[brandonkelly]

I don’t think replacing the host name to the site’s host name would be expected either, if that’s what you’re suggesting. The only other behavior I would consider here is to throw an exception in the event the passed-in “path” turns out to be an absolute/root-relative/protocol-relative URL.

[mmikkel]

Maybe it could return null, false or an empty string?

[brandonkelly]

An InvalidArgumentException would make more sense than those, I think.