Plugin Directory: Treat the plugin file header like the readme section it replaces on import - #881
Plugin Directory: Treat the plugin file header like the readme section it replaces on import#881mcliwanow wants to merge 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📝 WalkthroughWalkthroughThe parser now exposes ChangesReadme filtering
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to Fallback plugin-header descriptions now receive the same safe markup filtering as readme sections, with covered allow-list behavior. No current merge-blocking risk is identified. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…n it replaces on import When a plugin has no readme, the importer fills the description section from the plugin file's `Description:` header. The header went in as written, while a readme section is narrowed by the readme parser before it is stored, and the `Name:` header on the neighbouring line already goes through `strip_tags()`. The description fallback now runs through `Readme\Parser::filter_text()`, which becomes public for that instead of the importer carrying a copy of the section allow-list. A parser test pins what `filter_text()` keeps and drops. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2763803 to
0937ad6
Compare
mcliwanow
changed the title
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
1 participant
Why
When a plugin has no readme, the importer builds the description section from the plugin file's
Description:header and stores the header as written. Every other value that reaches that column is narrowed first: readme sections go through the parser's section allow-list infilter_text(), and theName:header three lines up in the same block goes throughstrip_tags(). The header fallback was the one exception, in a block that otherwise treats every input the same way.What changed
cli/class-import.phpnow runs throughReadme\Parser::filter_text(), so a header stands in for a readme section under the same rules as a section.filter_text()goes fromprotectedtopublicfor that. The alternative was a second copy of the allow-list in the importer, which would drift.filter_text()keeps (the section tags,awithhref/title/rel) and drops (other attributes, other elements), and that it balances an unclosed tag.<div>,<img>,class=,style=) shows that markup as text on its page. The excerpt, theheader_descriptionmeta and the upload form are unchanged.Testing
wp-env
environments/plugin-directory(WP trunk), the realImport::import_from_svn()run against three local plugin directories with only the SVN export step replaced, on trunk and on this branch, container restarted between. The same three posts each time, seeded asapproved; every import moved them topublish.<div>, a link, andidand other attributes on bothpost_contentholds the header as written; the page renders the<div>with every attributepost_contentkeeps the link with itshrefonly, the rest is text; the page renders one paragraph with a plain link<strong>,<a href title>,<code>, a bare&and a bare<<&and<encodedThe excerpt column is not touched by this change and stored the same value on both.
Summary by CodeRabbit
Bug Fixes
Tests