Component fuzzers

src/wp-admin/includes/class-wp-application-passwords-list-table.php

@@ -97,7 +97,7 @@ public function column_last_ip( $item ) {
 		if ( empty( $item['last_ip'] ) ) {
 			echo '—';
 		} else {
-			echo $item['last_ip'];
+			echo esc_html( $item['last_ip'] );
 		}
 	}
 

src/wp-includes/ai-client/adapters/class-wp-ai-client-http-client.php

@@ -216,7 +216,7 @@ private function create_psr_response( array $wp_response ): ResponseInterface {
 			}
 		}
 
-		if ( ! empty( $body ) ) {
+		if ( '' !== $body ) {
 			$stream   = $this->stream_factory->createStream( $body );
 			$response = $response->withBody( $stream );
 		}

src/wp-includes/block-template-utils.php

@@ -343,8 +343,18 @@ function _get_block_template_file( $template_type, $slug ) {
 	);
 	foreach ( $themes as $theme_slug => $theme_dir ) {
 		$template_base_paths = get_block_theme_folders( $theme_slug );
-		$file_path           = $theme_dir . '/' . $template_base_paths[ $template_type ] . '/' . $slug . '.html';
-		if ( file_exists( $file_path ) ) {
+		$template_base_path  = $theme_dir . '/' . $template_base_paths[ $template_type ];
+		$file_path           = $template_base_path . '/' . $slug . '.html';
+		$real_base_path      = realpath( $template_base_path );
+		$real_file_path      = realpath( $file_path );
+		if (
+			false !== $real_base_path &&
+			false !== $real_file_path &&
+			str_starts_with(
+				wp_normalize_path( $real_file_path ),
+				trailingslashit( wp_normalize_path( $real_base_path ) )
+			)
+		) {
 			$new_template_item = array(
 				'slug'  => $slug,
 				'path'  => $file_path,

src/wp-includes/class-wp-block-metadata-registry.php

@@ -82,7 +82,7 @@ class WP_Block_Metadata_Registry {
 	 * @return bool True if the collection was registered successfully, false otherwise.
 	 */
 	public static function register_collection( $path, $manifest ) {
-		$path = rtrim( wp_normalize_path( $path ), '/' );
+		$path = self::normalize_collection_path( $path );
 
 		$collection_roots = self::get_default_collection_roots();
 
@@ -112,7 +112,7 @@ public static function register_collection( $path, $manifest ) {
 		$collection_roots = array_unique(
 			array_map(
 				static function ( $allowed_root ) {
-					return rtrim( wp_normalize_path( $allowed_root ), '/' );
+					return self::normalize_collection_path( $allowed_root );
 				},
 				$collection_roots
 			)
@@ -161,7 +161,7 @@ static function ( $allowed_root ) {
 	 * @return array|null The block metadata for the block, or null if not found.
 	 */
 	public static function get_metadata( $file_or_folder ) {
-		$file_or_folder = wp_normalize_path( $file_or_folder );
+		$file_or_folder = self::normalize_collection_path( $file_or_folder );
 
 		$path = self::find_collection_path( $file_or_folder );
 		if ( ! $path ) {
@@ -196,7 +196,7 @@ public static function get_metadata( $file_or_folder ) {
 	 * @return string[] List of block metadata file paths, or an empty array if the given `$path` is invalid.
 	 */
 	public static function get_collection_block_metadata_files( $path ) {
-		$path = rtrim( wp_normalize_path( $path ), '/' );
+		$path = self::normalize_collection_path( $path );
 
 		if ( ! isset( self::$collections[ $path ] ) ) {
 			_doing_it_wrong(
@@ -223,6 +223,56 @@ static function ( $block_name ) use ( $path ) {
 		);
 	}
 
+	/**
+	 * Normalizes a collection path and collapses dot segments.
+	 *
+	 * @since 7.1.0
+	 *
+	 * @param string $path File or directory path.
+	 * @return string Normalized path without trailing slashes.
+	 */
+	private static function normalize_collection_path( $path ) {
+		$path = wp_normalize_path( $path );
+
+		$prefix = '';
+		if ( preg_match( '#^([A-Za-z][A-Za-z0-9+.-]*://)(.*)$#', $path, $matches ) ) {
+			$prefix = $matches[1];
+			$path   = $matches[2];
+		} elseif ( str_starts_with( $path, '//' ) ) {
+			$prefix = '//';
+			$path   = substr( $path, 2 );
+		}
+
+		$drive = '';
+		if ( preg_match( '#^[A-Za-z]:#', $path, $matches ) ) {
+			$drive = $matches[0];
+			$path  = substr( $path, 2 );
+		}
+
+		$is_absolute = str_starts_with( $path, '/' );
+		$parts       = array();
+
+		foreach ( explode( '/', $path ) as $part ) {
+			if ( '' === $part || '.' === $part ) {
+				continue;
+			}
+			if ( '..' === $part ) {
+				if ( array() !== $parts && '..' !== end( $parts ) ) {
+					array_pop( $parts );
+					continue;
+				}
+				if ( ! $is_absolute ) {
+					$parts[] = $part;
+				}
+				continue;
+			}
+			$parts[] = $part;
+		}
+
+		$normalized = ( $is_absolute ? '/' : '' ) . implode( '/', $parts );
+		return $prefix . rtrim( $drive . $normalized, '/' );
+	}
+
 	/**
 	 * Finds the collection path for a given file or folder.
 	 *
@@ -238,20 +288,33 @@ private static function find_collection_path( $file_or_folder ) {
 
 		// Check the last matched collection first, since block registration usually happens in batches per plugin or theme.
 		$path = rtrim( $file_or_folder, '/' );
-		if ( self::$last_matched_collection && str_starts_with( $path, self::$last_matched_collection ) ) {
+		if ( self::$last_matched_collection && self::is_same_or_child_path( $path, self::$last_matched_collection ) ) {
 			return self::$last_matched_collection;
 		}
 
 		$collection_paths = array_keys( self::$collections );
 		foreach ( $collection_paths as $collection_path ) {
-			if ( str_starts_with( $path, $collection_path ) ) {
+			if ( self::is_same_or_child_path( $path, $collection_path ) ) {
 				self::$last_matched_collection = $collection_path;
 				return $collection_path;
 			}
 		}
 		return null;
 	}
 
+	/**
+	 * Checks whether a path is equal to or inside another path.
+	 *
+	 * @since 7.1.0
+	 *
+	 * @param string $path      Normalized path.
+	 * @param string $base_path Normalized base path.
+	 * @return bool True if the path is the base path or a child path, false otherwise.
+	 */
+	private static function is_same_or_child_path( $path, $base_path ) {
+		return $path === $base_path || str_starts_with( $path, $base_path . '/' );
+	}
+
 	/**
 	 * Checks if metadata exists for a given block name in a specific collection.
 	 *
@@ -317,7 +380,7 @@ private static function is_valid_collection_path( $path, $collection_roots ) {
 			}
 
 			// If the path is a parent path of any of the roots, it is invalid.
-			if ( str_starts_with( $allowed_root, $path ) ) {
+			if ( self::is_same_or_child_path( $allowed_root, $path ) ) {
 				return false;
 			}
 		}

src/wp-includes/class-wp-email-address.php

@@ -17,9 +17,9 @@
  *
  * Example:
  *
- *     $email = WP_Email_Address::from_string( 'wordpress@wordpress.org' );
- *     'wordpress'     === $email->get_local_part();
- *     'wordpress.org' === $email->get_domain();
+ *     $email = WP_Email_Address::from_string( 'user@example.org' );
+ *     'user'        === $email->get_local_part();
+ *     'example.org' === $email->get_domain();
  *
  * @see self::from_string()        to parse and validate a provided email address.
  * @see self::get_localpart()      for the local part or mailbox of the address.
@@ -288,19 +288,31 @@ public static function from_string( string $input, string $character_set = 'unic
 			}
 		}
 
-		// The domain must contain at least one dot.
-		if ( ! str_contains( $ascii_domain, '.' ) ) {
-			/** This filter is documented in wp-includes/formatting.php */
-			if ( ! apply_filters( 'is_email', false, $input, 'domain_no_periods' ) ) {
-				return null;
-			}
-		}
-
 		// Validate the domain against the allowed structure.
 		if ( 1 !== preg_match( $domain_pattern, $decoded_domain ) ) {
 			return null;
 		}
 
+		if ( $allow_unicode && 1 === preg_match( '/[\x80-\xff]/', $decoded_domain ) ) {
+			if ( ! function_exists( 'idn_to_ascii' ) ) {
+				return null;
+			}
+
+			$encoded_labels = array();
+			foreach ( explode( '.', $decoded_domain ) as $label ) {
+				$encoded_label = 1 === preg_match( '/[\x80-\xff]/', $label )
+					? idn_to_ascii( $label, IDNA_DEFAULT, INTL_IDNA_VARIANT_UTS46 )
+					: $label;
+
+				if ( false === $encoded_label || strlen( $encoded_label ) > 63 ) {
+					return null;
+				}
+
+				$encoded_labels[] = $encoded_label;
+			}
+			$ascii_domain = implode( '.', $encoded_labels );
+		}
+
 		return new self( $localpart, $ascii_domain, $decoded_domain );
 	}
 

src/wp-includes/class-wp-icons-registry.php

@@ -199,6 +199,8 @@ protected function register( $icon_name, $icon_properties ) {
 				);
 				return false;
 			}
+
+			$icon_properties['content'] = $sanitized_icon_content;
 		}
 
 		$icon = array_merge(

src/wp-includes/class-wp-token-map.php

@@ -662,7 +662,7 @@ public function to_array(): array {
 		}
 
 		foreach ( $this->large_words as $index => $group ) {
-			$prefix       = substr( $this->groups, $index * ( $this->key_length + 1 ), 2 );
+			$prefix       = substr( $this->groups, $index * ( $this->key_length + 1 ), $this->key_length );
 			$group_length = strlen( $group );
 			$at           = 0;
 			while ( $at < $group_length ) {

src/wp-includes/class-wp-user.php

@@ -254,8 +254,27 @@ public static function get_data_by( $field, $value ) {
 			}
 		}
 
+		if ( 'email' === $field ) {
+			$users = $wpdb->get_results(
+				$wpdb->prepare(
+					"SELECT * FROM $wpdb->users WHERE user_email = %s",
+					$value
+				)
+			);
+
+			foreach ( $users as $user ) {
+				if ( 0 === strcasecmp( $user->user_email, $value ) ) {
+					update_user_caches( $user );
+					return $user;
+				}
+			}
+
+			return false;
+		}
+
 		$user = $wpdb->get_row(
 			$wpdb->prepare(
+				// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The column name is selected by the hardcoded switch above.
 				"SELECT * FROM $wpdb->users WHERE $db_field = %s LIMIT 1",
 				$value
 			)

src/wp-includes/fonts/class-wp-font-face.php

@@ -311,13 +311,7 @@ private function build_font_face_css( array $font_face ) {
 		 * Wrap font-family in quotes if it contains spaces
 		 * and is not already wrapped in quotes.
 		 */
-		if (
-			str_contains( $font_face['font-family'], ' ' ) &&
-			! str_contains( $font_face['font-family'], '"' ) &&
-			! str_contains( $font_face['font-family'], "'" )
-		) {
-			$font_face['font-family'] = '"' . $font_face['font-family'] . '"';
-		}
+		$font_face['font-family'] = $this->compile_font_family( $font_face['font-family'] );
 
 		foreach ( $font_face as $key => $value ) {
 			// Compile the "src" parameter.
@@ -338,6 +332,47 @@ private function build_font_face_css( array $font_face ) {
 		return $css;
 	}
 
+	/**
+	 * Compiles the `font-family` into valid CSS.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param string $value Value to process.
+	 * @return string The CSS.
+	 */
+	private function compile_font_family( $value ) {
+		if ( $this->font_family_needs_quotes( $value ) ) {
+			return '"' . $this->escape_css_string( $value, '"' ) . '"';
+		}
+
+		return $value;
+	}
+
+	/**
+	 * Checks whether a font family value should be quoted.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param string $value Value to process.
+	 * @return bool Whether the font family value should be quoted.
+	 */
+	private function font_family_needs_quotes( $value ) {
+		if (
+			str_contains( $value, ';' ) ||
+			str_contains( $value, '{' ) ||
+			str_contains( $value, '}' ) ||
+			str_contains( $value, '/*' ) ||
+			str_contains( $value, '*/' ) ||
+			preg_match( '/[\x00-\x1F\x7F]/', $value )
+		) {
+			return true;
+		}
+
+		return str_contains( $value, ' ' ) &&
+			! str_contains( $value, '"' ) &&
+			! str_contains( $value, "'" );
+	}
+
 	/**
 	 * Compiles the `src` into valid CSS.
 	 *
@@ -350,15 +385,39 @@ private function compile_src( array $value ) {
 		$src = '';
 
 		foreach ( $value as $item ) {
-			$src .= ( 'data' === $item['format'] )
-				? ", url({$item['url']})"
-				: ", url('{$item['url']}') format('{$item['format']}')";
+			$src .= ", url('" . $this->escape_css_string( $item['url'], "'" ) . "')";
+
+			if ( 'data' !== $item['format'] ) {
+				$src .= " format('" . $this->escape_css_string( $item['format'], "'" ) . "')";
+			}
 		}
 
 		$src = ltrim( $src, ', ' );
 		return $src;
 	}
 
+	/**
+	 * Escapes a value for use in a quoted CSS string.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param string $value Value to process.
+	 * @param string $quote Quote character wrapping the CSS string.
+	 * @return string Escaped CSS string content.
+	 */
+	private function escape_css_string( $value, $quote ) {
+		$value = str_replace( '\\', '\\\\', $value );
+		$value = str_replace( $quote, '\\' . $quote, $value );
+
+		return preg_replace_callback(
+			'/[\x00-\x1F\x7F]/',
+			static function ( $matches ) {
+				return '\\' . strtoupper( dechex( ord( $matches[0] ) ) ) . ' ';
+			},
+			$value
+		);
+	}
+
 	/**
 	 * Compiles the font variation settings.
 	 *