Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(security): Divi-markup refusal sees content as storage will (ruling S52)

Browse Source 
Control characters removed by kses (wp_kses_no_null: C0, \\0 sequences)
or ControlChars (DEL) could hide a divi/* delimiter or an et_pb shortcode
from the raw-input check. The shared DiviMarkup helper checks the raw
and the normalized form and now guards every raw-content path:
content-create/-update content and media-update description (attachment
post_content). MediaImporter logs import failures with scheme, host,
port and path only; uninstall.php lists the removed user meta.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 19:50:31 +02:00
co-authored by Claude Opus 5.5
parent b24d90d8b0
commit 99eda25452
10 changed files with 173 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Media/MediaImporterTest.php
+16
View File
@@ -506,4 +506,20 @@ final class MediaImporterTest extends TestCase
$this->expectException(\WpOrg\Requests\Exception::class);
$listener('http://169.254.169.254/latest/meta-data/');
}
/** Fix round 1: the log names scheme, host and path only – no credentials, no query string. */
public function testTheFailureLogOmitsUserinfoAndQuery(): void
{
Functions\when('wp_http_validate_url')->returnArg();
Functions\when('wp_parse_url')->alias('parse_url');
Functions\when('wp_safe_remote_get')->justReturn(new WP_Error('http_request_failed', 'timed out'));
$this->importer()->fromUrl('https://nutzer:geheim@example.com:8443/bilder/a.jpg?token=abc#x', null, []);
$log = (string) file_get_contents($this->errorLog);
self::assertStringContainsString('https://example.com:8443/bilder/a.jpg', $log);
self::assertStringNotContainsString('geheim', $log);
self::assertStringNotContainsString('nutzer', $log);
self::assertStringNotContainsString('token=abc', $log);
}
}