Component fuzzers

src/wp-admin/includes/class-wp-application-passwords-list-table.php

@@ -97,7 +97,7 @@ public function column_last_ip( $item ) {
 		if ( empty( $item['last_ip'] ) ) {
 			echo '—';
 		} else {
-			echo $item['last_ip'];
+			echo esc_html( $item['last_ip'] );
 		}
 	}
 

src/wp-includes/ai-client/adapters/class-wp-ai-client-http-client.php

@@ -217,7 +217,7 @@ private function create_psr_response( array $wp_response ): ResponseInterface {
 			}
 		}
 
-		if ( ! empty( $body ) ) {
+		if ( '' !== $body ) {
 			$stream   = $this->stream_factory->createStream( $body );
 			$response = $response->withBody( $stream );
 		}

src/wp-includes/block-template-utils.php

@@ -343,8 +343,18 @@ function _get_block_template_file( $template_type, $slug ) {
 	);
 	foreach ( $themes as $theme_slug => $theme_dir ) {
 		$template_base_paths = get_block_theme_folders( $theme_slug );
-		$file_path           = $theme_dir . '/' . $template_base_paths[ $template_type ] . '/' . $slug . '.html';
-		if ( file_exists( $file_path ) ) {
+		$template_base_path  = $theme_dir . '/' . $template_base_paths[ $template_type ];
+		$file_path           = $template_base_path . '/' . $slug . '.html';
+		$real_base_path      = realpath( $template_base_path );
+		$real_file_path      = realpath( $file_path );
+		if (
+			false !== $real_base_path &&
+			false !== $real_file_path &&
+			str_starts_with(
+				wp_normalize_path( $real_file_path ),
+				trailingslashit( wp_normalize_path( $real_base_path ) )
+			)
+		) {
 			$new_template_item = array(
 				'slug'  => $slug,
 				'path'  => $file_path,

src/wp-includes/class-wp-block-metadata-registry.php

@@ -82,7 +82,7 @@ class WP_Block_Metadata_Registry {
 	 * @return bool True if the collection was registered successfully, false otherwise.
 	 */
 	public static function register_collection( $path, $manifest ) {
-		$path = rtrim( wp_normalize_path( $path ), '/' );
+		$path = self::normalize_collection_path( $path );
 
 		$collection_roots = self::get_default_collection_roots();
 
@@ -112,7 +112,7 @@ public static function register_collection( $path, $manifest ) {
 		$collection_roots = array_unique(
 			array_map(
 				static function ( $allowed_root ) {
-					return rtrim( wp_normalize_path( $allowed_root ), '/' );
+					return self::normalize_collection_path( $allowed_root );
 				},
 				$collection_roots
 			)
@@ -161,7 +161,7 @@ static function ( $allowed_root ) {
 	 * @return array|null The block metadata for the block, or null if not found.
 	 */
 	public static function get_metadata( $file_or_folder ) {
-		$file_or_folder = wp_normalize_path( $file_or_folder );
+		$file_or_folder = self::normalize_collection_path( $file_or_folder );
 
 		$path = self::find_collection_path( $file_or_folder );
 		if ( ! $path ) {
@@ -196,7 +196,7 @@ public static function get_metadata( $file_or_folder ) {
 	 * @return string[] List of block metadata file paths, or an empty array if the given `$path` is invalid.
 	 */
 	public static function get_collection_block_metadata_files( $path ) {
-		$path = rtrim( wp_normalize_path( $path ), '/' );
+		$path = self::normalize_collection_path( $path );
 
 		if ( ! isset( self::$collections[ $path ] ) ) {
 			_doing_it_wrong(
@@ -223,6 +223,56 @@ static function ( $block_name ) use ( $path ) {
 		);
 	}
 
+	/**
+	 * Normalizes a collection path and collapses dot segments.
+	 *
+	 * @since 7.1.0
+	 *
+	 * @param string $path File or directory path.
+	 * @return string Normalized path without trailing slashes.
+	 */
+	private static function normalize_collection_path( $path ) {
+		$path = wp_normalize_path( $path );
+
+		$prefix = '';
+		if ( preg_match( '#^([A-Za-z][A-Za-z0-9+.-]*://)(.*)$#', $path, $matches ) ) {
+			$prefix = $matches[1];
+			$path   = $matches[2];
+		} elseif ( str_starts_with( $path, '//' ) ) {
+			$prefix = '//';
+			$path   = substr( $path, 2 );
+		}
+
+		$drive = '';
+		if ( preg_match( '#^[A-Za-z]:#', $path, $matches ) ) {
+			$drive = $matches[0];
+			$path  = substr( $path, 2 );
+		}
+
+		$is_absolute = str_starts_with( $path, '/' );
+		$parts       = array();
+
+		foreach ( explode( '/', $path ) as $part ) {
+			if ( '' === $part || '.' === $part ) {
+				continue;
+			}
+			if ( '..' === $part ) {
+				if ( array() !== $parts && '..' !== end( $parts ) ) {
+					array_pop( $parts );
+					continue;
+				}
+				if ( ! $is_absolute ) {
+					$parts[] = $part;
+				}
+				continue;
+			}
+			$parts[] = $part;
+		}
+
+		$normalized = ( $is_absolute ? '/' : '' ) . implode( '/', $parts );
+		return $prefix . rtrim( $drive . $normalized, '/' );
+	}
+
 	/**
 	 * Finds the collection path for a given file or folder.
 	 *
@@ -238,20 +288,33 @@ private static function find_collection_path( $file_or_folder ) {
 
 		// Check the last matched collection first, since block registration usually happens in batches per plugin or theme.
 		$path = rtrim( $file_or_folder, '/' );
-		if ( self::$last_matched_collection && str_starts_with( $path, self::$last_matched_collection ) ) {
+		if ( self::$last_matched_collection && self::is_same_or_child_path( $path, self::$last_matched_collection ) ) {
 			return self::$last_matched_collection;
 		}
 
 		$collection_paths = array_keys( self::$collections );
 		foreach ( $collection_paths as $collection_path ) {
-			if ( str_starts_with( $path, $collection_path ) ) {
+			if ( self::is_same_or_child_path( $path, $collection_path ) ) {
 				self::$last_matched_collection = $collection_path;
 				return $collection_path;
 			}
 		}
 		return null;
 	}
 
+	/**
+	 * Checks whether a path is equal to or inside another path.
+	 *
+	 * @since 7.1.0
+	 *
+	 * @param string $path      Normalized path.
+	 * @param string $base_path Normalized base path.
+	 * @return bool True if the path is the base path or a child path, false otherwise.
+	 */
+	private static function is_same_or_child_path( $path, $base_path ) {
+		return $path === $base_path || str_starts_with( $path, $base_path . '/' );
+	}
+
 	/**
 	 * Checks if metadata exists for a given block name in a specific collection.
 	 *
@@ -317,7 +380,7 @@ private static function is_valid_collection_path( $path, $collection_roots ) {
 			}
 
 			// If the path is a parent path of any of the roots, it is invalid.
-			if ( str_starts_with( $allowed_root, $path ) ) {
+			if ( self::is_same_or_child_path( $allowed_root, $path ) ) {
 				return false;
 			}
 		}

src/wp-includes/class-wp-token-map.php

@@ -662,7 +662,7 @@ public function to_array(): array {
 		}
 
 		foreach ( $this->large_words as $index => $group ) {
-			$prefix       = substr( $this->groups, $index * ( $this->key_length + 1 ), 2 );
+			$prefix       = substr( $this->groups, $index * ( $this->key_length + 1 ), $this->key_length );
 			$group_length = strlen( $group );
 			$at           = 0;
 			while ( $at < $group_length ) {

src/wp-includes/class-wp-user.php

@@ -254,8 +254,27 @@ public static function get_data_by( $field, $value ) {
 			}
 		}
 
+		if ( 'email' === $field ) {
+			$users = $wpdb->get_results(
+				$wpdb->prepare(
+					"SELECT * FROM $wpdb->users WHERE user_email = %s",
+					$value
+				)
+			);
+
+			foreach ( $users as $user ) {
+				if ( 0 === strcasecmp( $user->user_email, $value ) ) {
+					update_user_caches( $user );
+					return $user;
+				}
+			}
+
+			return false;
+		}
+
 		$user = $wpdb->get_row(
 			$wpdb->prepare(
+				// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The column name is selected by the hardcoded switch above.
 				"SELECT * FROM $wpdb->users WHERE $db_field = %s LIMIT 1",
 				$value
 			)

src/wp-includes/fonts/class-wp-font-face.php

@@ -311,13 +311,7 @@ private function build_font_face_css( array $font_face ) {
 		 * Wrap font-family in quotes if it contains spaces
 		 * and is not already wrapped in quotes.
 		 */
-		if (
-			str_contains( $font_face['font-family'], ' ' ) &&
-			! str_contains( $font_face['font-family'], '"' ) &&
-			! str_contains( $font_face['font-family'], "'" )
-		) {
-			$font_face['font-family'] = '"' . $font_face['font-family'] . '"';
-		}
+		$font_face['font-family'] = $this->compile_font_family( $font_face['font-family'] );
 
 		foreach ( $font_face as $key => $value ) {
 			// Compile the "src" parameter.
@@ -338,6 +332,47 @@ private function build_font_face_css( array $font_face ) {
 		return $css;
 	}
 
+	/**
+	 * Compiles the `font-family` into valid CSS.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param string $value Value to process.
+	 * @return string The CSS.
+	 */
+	private function compile_font_family( $value ) {
+		if ( $this->font_family_needs_quotes( $value ) ) {
+			return '"' . $this->escape_css_string( $value, '"' ) . '"';
+		}
+
+		return $value;
+	}
+
+	/**
+	 * Checks whether a font family value should be quoted.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param string $value Value to process.
+	 * @return bool Whether the font family value should be quoted.
+	 */
+	private function font_family_needs_quotes( $value ) {
+		if (
+			str_contains( $value, ';' ) ||
+			str_contains( $value, '{' ) ||
+			str_contains( $value, '}' ) ||
+			str_contains( $value, '/*' ) ||
+			str_contains( $value, '*/' ) ||
+			preg_match( '/[\x00-\x1F\x7F]/', $value )
+		) {
+			return true;
+		}
+
+		return str_contains( $value, ' ' ) &&
+			! str_contains( $value, '"' ) &&
+			! str_contains( $value, "'" );
+	}
+
 	/**
 	 * Compiles the `src` into valid CSS.
 	 *
@@ -350,15 +385,39 @@ private function compile_src( array $value ) {
 		$src = '';
 
 		foreach ( $value as $item ) {
-			$src .= ( 'data' === $item['format'] )
-				? ", url({$item['url']})"
-				: ", url('{$item['url']}') format('{$item['format']}')";
+			$src .= ", url('" . $this->escape_css_string( $item['url'], "'" ) . "')";
+
+			if ( 'data' !== $item['format'] ) {
+				$src .= " format('" . $this->escape_css_string( $item['format'], "'" ) . "')";
+			}
 		}
 
 		$src = ltrim( $src, ', ' );
 		return $src;
 	}
 
+	/**
+	 * Escapes a value for use in a quoted CSS string.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param string $value Value to process.
+	 * @param string $quote Quote character wrapping the CSS string.
+	 * @return string Escaped CSS string content.
+	 */
+	private function escape_css_string( $value, $quote ) {
+		$value = str_replace( '\\', '\\\\', $value );
+		$value = str_replace( $quote, '\\' . $quote, $value );
+
+		return preg_replace_callback(
+			'/[\x00-\x1F\x7F]/',
+			static function ( $matches ) {
+				return '\\' . strtoupper( dechex( ord( $matches[0] ) ) ) . ' ';
+			},
+			$value
+		);
+	}
+
 	/**
 	 * Compiles the font variation settings.
 	 *

src/wp-includes/formatting.php

@@ -2056,6 +2056,9 @@ function sanitize_file_name( $filename ) {
 		 * @see https://www.php.net/manual/en/regexp.reference.unicode.php
 		 */
 		$filename = preg_replace( '#\p{Zs}#siu', ' ', $filename );
+		if ( null === $filename ) {
+			$filename = '';
+		}
 	}
 
 	/**
@@ -3209,7 +3212,7 @@ function make_clickable( $text ) {
 			$ret = preg_replace_callback( $url_clickable, '_make_url_clickable_cb', $ret );
 
 			$ret = preg_replace_callback( '#([\s>])((www|ftp)\.[\w\\x80-\\xff\#$%&~/.\-;:=,?@\[\]+]+)#is', '_make_web_ftp_clickable_cb', $ret );
-			$ret = preg_replace_callback( '#([\s>])([.0-9a-z_+-]+)@(([0-9a-z-]+\.)+[0-9a-z]{2,})#i', '_make_email_clickable_cb', $ret );
+			$ret = preg_replace_callback( '#([\s>])([.0-9a-z_+-]+)@(([0-9a-z-]+\.)+(?:xn--[0-9a-z-]*[0-9a-z]|[0-9a-z]{2,}))(?![0-9a-z-])#i', '_make_email_clickable_cb', $ret );
 
 			$ret = substr( $ret, 1, -1 ); // Remove our whitespace padding.
 			$r  .= $ret;

src/wp-includes/php-ai-client/src/Providers/Http/HttpTransporter.php

@@ -75,6 +75,8 @@ public function send(Request $request, ?RequestOptions $options = null): Respons
             } else {
                 $psr7Response = $this->client->sendRequest($psr7Request);
             }
+        } catch (NetworkException $e) {
+            throw NetworkException::fromPsr18NetworkException($psr7Request, $e);
         } catch (\WordPress\AiClientDependencies\Psr\Http\Client\NetworkExceptionInterface $e) {
             throw NetworkException::fromPsr18NetworkException($psr7Request, $e);
         } catch (\WordPress\AiClientDependencies\Psr\Http\Client\ClientExceptionInterface $e) {

src/wp-includes/pluggable.php

@@ -448,7 +448,7 @@ function wp_mail( $to, $subject, $message, $headers = '', $attachments = array()
 		try {
 			$phpmailer->setFrom( $from_email, $from_name, false );
 		} catch ( PHPMailer\PHPMailer\Exception $e ) {
-			$mail_error_data                             = compact( 'to', 'subject', 'message', 'headers', 'attachments' );
+			$mail_error_data                             = compact( 'to', 'subject', 'message', 'headers', 'attachments', 'embeds' );
 			$mail_error_data['phpmailer_exception_code'] = $e->getCode();
 
 			/** This filter is documented in wp-includes/pluggable.php */

src/wp-includes/post.php

@@ -1869,6 +1869,15 @@ function register_post_type( $post_type, $args = array() ) {
 		return new WP_Error( 'post_type_length_invalid', __( 'Post type names must be between 1 and 20 characters in length.' ) );
 	}
 
+	// Re-registration replaces the object; clean side effects from the old object first.
+	if ( isset( $wp_post_types[ $post_type ] ) && $wp_post_types[ $post_type ] instanceof WP_Post_Type && ! $wp_post_types[ $post_type ]->_builtin ) {
+		$wp_post_types[ $post_type ]->remove_supports();
+		$wp_post_types[ $post_type ]->remove_rewrite_rules();
+		$wp_post_types[ $post_type ]->unregister_meta_boxes();
+		$wp_post_types[ $post_type ]->remove_hooks();
+		$wp_post_types[ $post_type ]->unregister_taxonomies();
+	}
+
 	$post_type_object = new WP_Post_Type( $post_type, $args );
 	$post_type_object->add_supports();
 	$post_type_object->add_rewrite_rules();