GH#812: fix: sanitize subdomain slug in wu_create_site#822
Conversation
…ostnames Resolves #812 The subdomain slug derived from site_data['path'] was interpolated directly into a hostname without sanitization. Malformed or special-character paths could produce invalid domain names. Now the slug is sanitized through sanitize_title_with_dashes(wu_clean()) and validated to be non-empty before use, returning WP_Error for completely invalid paths. Note: fixes 1 (domain normalization) and 3 (site_id default) from the original review feedback were already implemented in prior PRs.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 46 minutes and 10 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Merge SummaryWhat changed:
Why: Testing:
Risk: Low — change only affects the subdomain conversion path in |
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
Merge SummaryWhat changed:
Why: Testing:
Risk: Low — change only affects the subdomain conversion path in Merged via PR #822 to main. aidevops.sh v3.8.6 spent 11m on this as a headless bash routine. |
|
Performance Test Results Performance test results for 77946a9 are in 🛎️! Note: the numbers in parentheses show the difference to the previous (baseline) test run. Differences below 2% or 0.5 in absolute values are not shown. URL:
|
…ation Adds two integration tests to Site_Functions_Extended_Test that verify the subdomain slug sanitization introduced in GH#812 (PR #822) works end-to-end at the wu_create_site() API level: - test_create_site_sanitizes_subdomain_slug: verifies that a path with special characters (e.g. '/My Cool Site!/') produces a sanitized subdomain hostname containing 'my-cool-site' and does NOT fail with 'invalid_site_path'. - test_create_site_returns_error_for_empty_subdomain_slug: verifies that a path of only invalid characters (e.g. '/!!!/') returns WP_Error with 'invalid_site_path', preventing malformed hostnames. To make these tests runnable in the subdirectory test environment (where is_subdomain_install() checks the SUBDOMAIN_INSTALL constant), a new filter 'wu_is_subdomain_install' wraps the is_subdomain_install() call in wu_create_site(). Tests override via add_filter('wu_is_subdomain_install', '__return_true') to force the subdomain code path without redefining constants. Resolves #826
…ation Adds two integration tests to Site_Functions_Extended_Test that verify the subdomain slug sanitization introduced in GH#812 (PR #822) works end-to-end at the wu_create_site() API level: - test_create_site_sanitizes_subdomain_slug: verifies that a path with special characters (e.g. '/My Cool Site!/') produces a sanitized subdomain hostname containing 'my-cool-site' and does NOT fail with 'invalid_site_path'. - test_create_site_returns_error_for_empty_subdomain_slug: verifies that a path of only invalid characters (e.g. '/!!!/') returns WP_Error with 'invalid_site_path', preventing malformed hostnames. To make these tests runnable in the subdirectory test environment (where is_subdomain_install() checks the SUBDOMAIN_INSTALL constant), a new filter 'wu_is_subdomain_install' wraps the is_subdomain_install() call in wu_create_site(). Tests override via add_filter('wu_is_subdomain_install', '__return_true') to force the subdomain code path without redefining constants. Resolves #826
…ation (#828) Adds two integration tests to Site_Functions_Extended_Test that verify the subdomain slug sanitization introduced in GH#812 (PR #822) works end-to-end at the wu_create_site() API level: - test_create_site_sanitizes_subdomain_slug: verifies that a path with special characters (e.g. '/My Cool Site!/') produces a sanitized subdomain hostname containing 'my-cool-site' and does NOT fail with 'invalid_site_path'. - test_create_site_returns_error_for_empty_subdomain_slug: verifies that a path of only invalid characters (e.g. '/!!!/') returns WP_Error with 'invalid_site_path', preventing malformed hostnames. To make these tests runnable in the subdirectory test environment (where is_subdomain_install() checks the SUBDOMAIN_INSTALL constant), a new filter 'wu_is_subdomain_install' wraps the is_subdomain_install() call in wu_create_site(). Tests override via add_filter('wu_is_subdomain_install', '__return_true') to force the subdomain code path without redefining constants. Resolves #826
1 participant
Summary
Resolves #812
Addresses the remaining unresolved review bot feedback from PR #755: sanitize and validate the derived subdomain slug before building the
domaininwu_create_site().Context: PR #755 was merged with 3 unaddressed CodeRabbit suggestions. Two of them (domain normalization and
site_iddefault) were already implemented in prior work. This PR implements the third: subdomain slug sanitization.Changes
inc/functions/site.phpsanitize_title_with_dashes(wu_clean())before being interpolated into a hostname. This prevents invalid characters, mixed case, and special characters from producing malformed domain names.!!!), the function returns aWP_Error('invalid_site_path')instead of creating a site with an invalid domain.tests/WP_Ultimo/Functions/Site_Functions_Extended_Test.phpMy Cool Site!→my-cool-site)Testing
All 21 tests in
Site_Functions_Extended_Testpass. All 18 tests inSite_Functions_Testpass.