Markdown import: Limit the source hosts, and escape the Learn image-link rewrite

[obenland]

Two plugins let an editor supply a URL that the site later fetches or renders, without constraining where it points.

WP-CLI (wporg-cli)

Handbook pages on make.wordpress.org/cli are imported from Markdown in the wp-cli GitHub organization, but the "Markdown source" field accepted any http(s) URL — and the fetched body is written straight into the post as content.

A new validate_markdown_source() limits sources to github.com and raw.githubusercontent.com, requires an http or https scheme, and requires the repository owner — the first path segment on both hosts — to be wp-cli. The hosts alone would still have served every repository and gist on GitHub; the handbook comes from one organization, and all 148 entries in the published manifest are github.com/wp-cli/…. Hosts and owners are both compared case insensitively, since GitHub serves them that way. It runs in three places:

• On save, along with the edit_post capability check action_save_post() was missing — it relied on the nonce alone, which is user-bound but is not a capability check. A rejected source leaves the stored one in place and reports it in an admin notice, since the prefilled field posts the stored value back on every save.
• On fetch, because the 15-minute wporg_cli_markdown_import cron reuses stored values as-is, so a save-time check alone would not cover existing rows.
• On manifest import, before the post is inserted. Otherwise a bad entry leaves behind a handbook page that every scheduled run then fails on. Skipped entries emit a WP_CLI::warning so a manifest regression stays visible.

Three smaller changes:

• wp_safe_remote_get() replaces wp_remote_get() for both the source and the manifest, so redirect targets are validated rather than followed anywhere. The manifest URL is a hardcoded constant, so that half closes nothing that was reachable; it just leaves no unvalidated request in either importer.
• The blob → raw URL rewrite is now case insensitive, matching how the host is validated. A mixed case blob URL passed validation but was left unrewritten, so GitHub's HTML page was fetched and parsed as Markdown into the post.
• $_POST is guarded against a non-string value, which would otherwise reach esc_url_raw() and fatal on PHP 8.

Learn (wporg-learn)

wporg-learn carries a near-verbatim copy of the same importer, but every one of its hooks has been commented out since 2020-08-12. One function is still live:

add_filter( 'the_content', array( 'WPOrg_Learn\Markdown_Import', 'replace_image_links' ) );

It concatenated the wporg_learn_markdown_source post meta straight into an <img src=""> attribute with no escaping. That meta key is never registered, so it has no sanitize or auth callback, and it carries no underscore prefix, leaving it editable as free text through the custom fields metabox the lesson-plan post type supports. A value containing a quote breaks out of the attribute: stored XSS, injectable by anyone who can edit a lesson plan.

The value is now escaped with esc_url(). It is deliberately not checked against the host allow-list — the hosts present in existing stored data aren't known from this repository, and dropping a legitimate one would break lesson plan images.

The remaining changes mirror the WP-CLI plugin so the importer is safe if it is ever re-activated, as the file's own comment anticipates. All of that is unreachable today.

Tests

Adds a PHPUnit suite for wporg-cli, following the layout the handbook plugin uses. It runs in the existing make environment, which already serves the other make.wordpress.org plugins, rather than in one of its own — wporg-cli runs make.wordpress.org/cli, and a second environment for the same site would only have duplicated it. The environment gains the handbook plugin, which registers the post type the importer operates on, and Jetpack, which supplies the WPCom_GHF_Markdown_Parser the import hands its Markdown to, so the importer can also be exercised by hand. Neither is a test dependency: the suite's bootstrap registers a stand-in post type and stubs the parser.

cd environments && npm run make:test      # all three suites in one environment
cd environments && npm run make:test:cli  # this plugin's suite alone

make:test starts the environment once and runs every suite it holds, so npm run now describes the same thing CI does. The workflow calls these scripts instead of reimplementing them: one matrix entry per environment, and the redundant polyfill install step is gone, since each environment's afterStart already installs PHPUnit and the polyfills. That also adds the CI coverage this suite was missing — it had npm scripts but no matrix entry, so it had never run on a pull request.

66 tests cover the accepted hosts and owners and the rejected ones (loopback, private ranges, link-local, lookalike hostnames, userinfo-prefixed authorities, non-HTTP schemes, protocol-relative URLs, other owners, owner lookalikes, an owner-less URL); that blob URLs are fetched from the raw host whatever case the host was entered in; that a disallowed stored source is rejected with no outbound request; that a disallowed or absent manifest source creates no post; that a rejected save keeps the stored source; that slashes added to $_POST don't survive into the stored value; and that a user without edit_post can't change a source.

There are no tests for wporg-learn — it has no PHPUnit suite or wp-env environment today, and adding one was out of scope. That leaves the esc_url() fix, the only change here that affects live behaviour on Learn, without a regression test.

Both new PHP files pass phpcs with no errors or warnings and declare strict_types. The modified files carry pre-existing violations; this PR adds none to either (wporg-cli 15/20 and wporg-learn 1/3, unchanged before and after).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.