Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: RemoteFileFetcher::fetch() prüft die URL selbst; Doppelprüfung im Schriften-Upload entfällt

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-19 18:26:35 +02:00
co-authored by Claude Sonnet 5.5
parent bfede30d33
commit 942e4220ed
4 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Divi/Design/DiviFontsUploadAbilityTest.php
+4 -1
View File
@@ -118,6 +118,9 @@ final class DiviFontsUploadAbilityTest extends TestCase
/** The fake fetcher's download: writes the body of $url into $tmp. */
public function fakeFetch(string $url, string $tmp, int $maxBytes, string $context): ?array
{
if (! $this->allowed($url)) { // like the real fetch(): a refused URL is never requested
return null;
}
$this->fetches[] = ['url' => $url, 'tmp' => $tmp, 'max' => $maxBytes, 'context' => $context];
$body = $this->bodies[$url] ?? null;
if ($body === null) {
@@ -258,7 +261,7 @@ final class DiviFontsUploadAbilityTest extends TestCase
self::assertToolError($result, 'font_fetch_failed');
self::assertSame(['files.ttf' => 'nicht abrufbar'], self::errorFields($result));
self::assertSame([self::WOFF2_URL], array_column($this->fetches, 'url'), 'fetch() skipped the refused URL');
self::assertSame([self::WOFF2_URL], array_column($this->fetches, 'url'), 'the refused URL was never requested');
$this->assertTempFilesRemoved();
}
tests/Unit/Integrations/Media/RemoteFileFetcherTest.php
+9
View File
@@ -84,6 +84,15 @@ final class RemoteFileFetcherTest extends TestCase
self::assertSame('wOF2DATA', file_get_contents($this->tmp));
}
public function testARefusedUrlIsNullAndNeverRequested(): void
{
Functions\expect('wp_safe_remote_get')->never();
self::assertNull($this->fetcher(['10.0.0.5'])->fetch('https://intern.example.com/x.woff2', $this->tmp, 2048, 'x'));
self::assertNull($this->fetcher()->fetch('file:///etc/passwd', $this->tmp, 2048, 'x'));
self::assertStringContainsString('URL refused', (string) file_get_contents($this->errorLog));
}
public function testAFailedRequestIsNullAndOnlyTheLogNamesTheReasonAndTheContext(): void
{
Functions\when('wp_safe_remote_get')->justReturn(new WP_Error('http_request_failed', 'Connection refused'));