%s
'; $tmp = sprintf( - trim($tmp), + trim($tmp, " \n\r\t\v\x00"), __('Enable this option to encode contact phone numbers', 'cleantalk-spam-protect'), __('There are a few requirements to the number format:', 'cleantalk-spam-protect'), __('Should starting with "+" symbol or opening brace', 'cleantalk-spam-protect'), diff --git a/lib/Cleantalk/ApbctWP/ContactsEncoder/Integrations/CEIntegrationGridBuilder.php b/lib/Cleantalk/ApbctWP/ContactsEncoder/Integrations/CEIntegrationGridBuilder.php index 1133f1edc..d803fb9b0 100644 --- a/lib/Cleantalk/ApbctWP/ContactsEncoder/Integrations/CEIntegrationGridBuilder.php +++ b/lib/Cleantalk/ApbctWP/ContactsEncoder/Integrations/CEIntegrationGridBuilder.php @@ -421,7 +421,7 @@ private function appendCardCssChunk($css) return; } - $css = trim($css); + $css = trim($css, " \n\r\t\v\x00"); if ( $css === '' ) { return; @@ -454,7 +454,7 @@ private function mergeCardCssChunks($chunks) continue; } - $chunk = trim($chunk); + $chunk = trim($chunk, " \n\r\t\v\x00"); if ( $chunk !== '' ) { $merged[] = $chunk; @@ -463,7 +463,7 @@ private function mergeCardCssChunks($chunks) if ( $merged === array() ) { return $this->isCardCssChunk($this->card_inline_css) - ? trim($this->card_inline_css) + ? trim($this->card_inline_css, " \n\r\t\v\x00") : ''; } @@ -471,7 +471,7 @@ private function mergeCardCssChunks($chunks) $this->card_inline_css !== '' && $this->isCardCssChunk($this->card_inline_css) ) { - $merged[] = trim($this->card_inline_css); + $merged[] = trim($this->card_inline_css, " \n\r\t\v\x00"); } return implode("\n", array_unique($merged)); @@ -626,7 +626,7 @@ private function readCssFromSrc($url) return ''; } - return trim($css); + return trim($css, " \n\r\t\v\x00"); } /** @@ -668,7 +668,7 @@ private function extractCardCssFromHtml($content) continue; } - $css = trim($css); + $css = trim($css, " \n\r\t\v\x00"); if ( $css !== '' ) { $chunks[] = $css; @@ -713,7 +713,7 @@ private function collectInlineCssFromQueue() foreach ( $data as $piece ) { if ( is_string($piece) && $this->isCardCssChunk($piece) ) { - $chunks[] = trim($piece); + $chunks[] = trim($piece, " \n\r\t\v\x00"); } } } diff --git a/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php b/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php index a0a64980a..e05b13f11 100644 --- a/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php +++ b/lib/Cleantalk/ApbctWP/ContactsEncoder/Shortcodes/ExcludedEncodeContentSC.php @@ -589,7 +589,7 @@ protected function removeDuplicateContactsOutsideShortcodes($title) $protected_contacts = array(); foreach ( $matches[1] as $inner_match ) { - $inner = trim($inner_match[0]); + $inner = trim($inner_match[0], " \n\r\t\v\x00"); if ( $inner !== '' ) { $protected_contacts[$inner] = true; } @@ -613,7 +613,7 @@ protected function removeDuplicateContactsOutsideShortcodes($title) $result .= $this->stripProtectedContactsFromPlainText(substr($title, $offset), array_keys($protected_contacts)); - return trim(preg_replace('/\s+/', ' ', $result)); + return trim(preg_replace('/\s+/', ' ', $result), " \n\r\t\v\x00"); } /** @@ -911,7 +911,7 @@ public function processTitleString($title, $strip_html = true) if ( $strip_html ) { $result = wp_strip_all_tags($result); - $result = trim(preg_replace('/\s+/', ' ', $result)); + $result = trim(preg_replace('/\s+/', ' ', $result), " \n\r\t\v\x00"); } return $result; @@ -929,7 +929,7 @@ public static function stripShortcodesForSlug($title) $title = preg_replace('/\[apbct_skip_encoding\](.*?)\[\/apbct_skip_encoding\]/s', '$1', $title); $title = preg_replace('/\[\/?apbct_skip_encoding\]/', '', $title); - return trim(preg_replace('/\s+/', ' ', $title)); + return trim(preg_replace('/\s+/', ' ', $title), " \n\r\t\v\x00"); } /** diff --git a/lib/Cleantalk/ApbctWP/Cron.php b/lib/Cleantalk/ApbctWP/Cron.php index 10953ac2a..1ce365021 100644 --- a/lib/Cleantalk/ApbctWP/Cron.php +++ b/lib/Cleantalk/ApbctWP/Cron.php @@ -67,10 +67,10 @@ public function getTasks() } $unserialize_options = array('allowed_classes' => false); - $unserialized = @unserialize(trim($result), $unserialize_options); + $unserialized = @unserialize(trim($result, " \n\r\t\v\x00"), $unserialize_options); if ( is_string($unserialized) && is_serialized($unserialized) ) { - $unserialized = @unserialize(trim($unserialized), $unserialize_options); + $unserialized = @unserialize(trim($unserialized, " \n\r\t\v\x00"), $unserialize_options); } return is_array($unserialized) ? $unserialized : array(); diff --git a/lib/Cleantalk/ApbctWP/FindSpam/CommentsChecker.php b/lib/Cleantalk/ApbctWP/FindSpam/CommentsChecker.php index e8ffefeb7..e01b2c08c 100644 --- a/lib/Cleantalk/ApbctWP/FindSpam/CommentsChecker.php +++ b/lib/Cleantalk/ApbctWP/FindSpam/CommentsChecker.php @@ -162,8 +162,8 @@ private static function removeSkipRoles(array $comments, array $skip_roles) private static function removeCommentsWithoutIPEmail(array $comments) { foreach ($comments as $index => $comment) { - $comment_ip = ! empty($comment->comment_author_IP) ? trim($comment->comment_author_IP) : false; - $comment_email = ! empty($comment->comment_author_email) ? trim($comment->comment_author_email) : false; + $comment_ip = ! empty($comment->comment_author_IP) ? trim($comment->comment_author_IP, " \n\r\t\v\x00") : false; + $comment_email = ! empty($comment->comment_author_email) ? trim($comment->comment_author_email, " \n\r\t\v\x00") : false; // Validate IP and Email $comment_ip = filter_var($comment_ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4); diff --git a/lib/Cleantalk/ApbctWP/FindSpam/UsersChecker.php b/lib/Cleantalk/ApbctWP/FindSpam/UsersChecker.php index a43635606..7a7124ed4 100644 --- a/lib/Cleantalk/ApbctWP/FindSpam/UsersChecker.php +++ b/lib/Cleantalk/ApbctWP/FindSpam/UsersChecker.php @@ -175,7 +175,7 @@ private static function removeUsersWithoutIPEmail(array $users) ? $ip_from_keeper : false; $user_ip = $ip_from_keeper; - $user_email = ! empty($user->user_email) ? trim($user->user_email) : false; + $user_email = ! empty($user->user_email) ? trim($user->user_email, " \n\r\t\v\x00") : false; // Validate IP and Email $user_ip = filter_var($user_ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4); diff --git a/lib/Cleantalk/ApbctWP/Firewall/SFW.php b/lib/Cleantalk/ApbctWP/Firewall/SFW.php index a8d6b0c54..4a13f0121 100644 --- a/lib/Cleantalk/ApbctWP/Firewall/SFW.php +++ b/lib/Cleantalk/ApbctWP/Firewall/SFW.php @@ -606,7 +606,7 @@ public static function sendLog($db, $log_table, $ct_key) $ids_invalid = array(); $data = array(); foreach ($logs as $_key => &$value) { - $ip = isset($value['ip']) ? trim((string)$value['ip']) : ''; + $ip = isset($value['ip']) ? trim((string)$value['ip'], " \n\r\t\v\x00") : ''; // Do not send empty/invalid IPs — they break cloud collectors. if ( Helper::ipValidate($ip) === false ) { diff --git a/lib/Cleantalk/ApbctWP/GetFieldsAny.php b/lib/Cleantalk/ApbctWP/GetFieldsAny.php index f5855482c..37c0726e6 100644 --- a/lib/Cleantalk/ApbctWP/GetFieldsAny.php +++ b/lib/Cleantalk/ApbctWP/GetFieldsAny.php @@ -255,7 +255,7 @@ public function prepareFields($email, $nickname, $emails_array) foreach ($name_chunks as $value) { $this->dto->nickname .= ($value ? $value . " " : ""); } - $this->dto->nickname = trim($this->dto->nickname); + $this->dto->nickname = trim($this->dto->nickname, " \n\r\t\v\x00"); } } @@ -358,9 +358,9 @@ private function processRecursive($arr) } // Removes shortcodes to do better spam filtration on server side. - $value_for_email = trim($this->stripShortcodes($value)); + $value_for_email = trim($this->stripShortcodes($value), " \n\r\t\v\x00"); // Removes whitespaces - $value = urldecode(trim($this->stripShortcodes($value))); // Fully cleaned message + $value = urldecode(trim($this->stripShortcodes($value), " \n\r\t\v\x00")); // Fully cleaned message // Email $value_for_email = Validate::isUrlencoded($value_for_email) ? urldecode($value_for_email) : $value_for_email; diff --git a/lib/Cleantalk/ApbctWP/RemoteCalls.php b/lib/Cleantalk/ApbctWP/RemoteCalls.php index 9be3b865e..98b682cab 100644 --- a/lib/Cleantalk/ApbctWP/RemoteCalls.php +++ b/lib/Cleantalk/ApbctWP/RemoteCalls.php @@ -515,7 +515,7 @@ public static function action__post_api_key() // phpcs:ignore PSR1.Methods.Camel header("Content-Type: application/json"); } - $key = trim(Request::getString('api_key')); + $key = trim(Request::getString('api_key'), " \n\r\t\v\x00"); if ( ! apbct_api_key__is_correct($key) ) { die(json_encode(['FAIL' => ['error' => 'Api key is incorrect']])); } diff --git a/lib/Cleantalk/ApbctWP/ServerRequirementsChecker/ServerRequirementsChecker.php b/lib/Cleantalk/ApbctWP/ServerRequirementsChecker/ServerRequirementsChecker.php index 555ffebab..6c36a1fd3 100644 --- a/lib/Cleantalk/ApbctWP/ServerRequirementsChecker/ServerRequirementsChecker.php +++ b/lib/Cleantalk/ApbctWP/ServerRequirementsChecker/ServerRequirementsChecker.php @@ -197,7 +197,7 @@ public function checkRequirements() */ private function normalizeMemoryLimit($val) { - $val = trim($val); + $val = trim($val, " \n\r\t\v\x00"); $last = strtolower($val[strlen($val) - 1]); $val = (int)$val; switch ($last) { diff --git a/lib/Cleantalk/ApbctWP/UpdatePlugin/DbColumnCreator.php b/lib/Cleantalk/ApbctWP/UpdatePlugin/DbColumnCreator.php index 3ae812be2..dba8eb2ff 100644 --- a/lib/Cleantalk/ApbctWP/UpdatePlugin/DbColumnCreator.php +++ b/lib/Cleantalk/ApbctWP/UpdatePlugin/DbColumnCreator.php @@ -134,9 +134,9 @@ private function updateIndexes($schema_indexes_raw, $db_column_names, &$errors) if (!isset($match[1], $match[3])) { continue; } - $keyword = strtoupper(trim($match[1])); + $keyword = strtoupper(trim($match[1], " \n\r\t\v\x00")); $explicit_name = !empty($match[2]) ? $match[2] : ''; - $columns_raw = trim($match[3]); + $columns_raw = trim($match[3], " \n\r\t\v\x00"); // Skip PRIMARY KEY as it should already exist if table has primary key if (strpos($keyword, 'PRIMARY') !== false) { @@ -256,7 +256,7 @@ private function updateIndexes($schema_indexes_raw, $db_column_names, &$errors) if (isset($schema_indexes[$index_name])) { $index_def = $schema_indexes[$index_name]; if (preg_match('/\(([^)]+)\)/', $index_def, $col_match) && isset($col_match[1])) { - $columns = trim($col_match[1]); + $columns = trim($col_match[1], " \n\r\t\v\x00"); $add_type = (stripos($index_def, 'UNIQUE') !== false) ? 'UNIQUE INDEX' : 'INDEX'; $sql = "ALTER TABLE `$this->dbTableName` ADD $add_type `$index_name` ($columns)"; $result = $wpdb->query($sql); @@ -293,7 +293,7 @@ private function updateIndexes($schema_indexes_raw, $db_column_names, &$errors) // Create proper SQL: ALTER TABLE `table` ADD INDEX `name` (`column`) // Parse the index definition to extract columns if (preg_match('/\(([^)]+)\)/', $index_def, $col_match) && isset($col_match[1])) { - $columns = trim($col_match[1]); + $columns = trim($col_match[1], " \n\r\t\v\x00"); $add_type = (stripos($index_def, 'UNIQUE') !== false) ? 'UNIQUE INDEX' : 'INDEX'; $sql = "ALTER TABLE `$this->dbTableName` ADD $add_type `$diff_index_name` ($columns)"; $result = $wpdb->query($sql); diff --git a/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php b/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php index 991461442..6664d4d80 100644 --- a/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php +++ b/lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php @@ -936,7 +936,11 @@ private function replaceAriaLabelWithPlaceholder($matches) */ private function isSecureAriaLabelPlaceholderAvailable() { - return function_exists('random_bytes') || function_exists('openssl_random_pseudo_bytes'); + if ( function_exists('random_bytes') ) { + return true; + } + + return function_exists('openssl_random_pseudo_bytes'); } /** @@ -945,38 +949,23 @@ private function isSecureAriaLabelPlaceholderAvailable() * @return string|null Null when no secure entropy source is available. */ private function generateAriaLabelPlaceholder() - { - $bytes = $this->getSecureRandomBytes(16); - if ( !is_string($bytes) || strlen($bytes) !== 16 ) { - return null; - } - - return '%%APBCT_ARIA_' . bin2hex($bytes) . '%%'; - } - - /** - * @param int $length - * - * @return string|null - */ - private function getSecureRandomBytes($length) { if ( function_exists('random_bytes') ) { try { - // phpcs:ignore PHPCompatibility.FunctionUse.NewFunctions.random_bytesFound - $bytes = random_bytes($length); - if ( is_string($bytes) && strlen($bytes) === $length ) { - return $bytes; + $bytes = random_bytes(16); + if ( is_string($bytes) && strlen($bytes) === 16 ) { + return '%%APBCT_ARIA_' . bin2hex($bytes) . '%%'; } } catch ( \Exception $e ) { - // Fall through to OpenSSL. + // fall through to openssl } } if ( function_exists('openssl_random_pseudo_bytes') ) { - $bytes = openssl_random_pseudo_bytes($length); - if ( is_string($bytes) && strlen($bytes) === $length ) { - return $bytes; + $crypto_strong = false; + $bytes = openssl_random_pseudo_bytes(16, $crypto_strong); + if ( $crypto_strong && is_string($bytes) && strlen($bytes) === 16 ) { + return '%%APBCT_ARIA_' . bin2hex($bytes) . '%%'; } } diff --git a/lib/Cleantalk/Common/Helper.php b/lib/Cleantalk/Common/Helper.php index 79e07925d..ee38aa92b 100644 --- a/lib/Cleantalk/Common/Helper.php +++ b/lib/Cleantalk/Common/Helper.php @@ -98,11 +98,11 @@ public static function ipGet($ip_type_to_get = 'real', $v4_only = true, $headers ? explode(',', $source) : (array)$source; if ( isset($tmp[0]) ) { - $ip_version = self::ipValidate(trim($tmp[0])); + $ip_version = self::ipValidate(trim($tmp[0], " \n\r\t\v\x00")); if ($ip_version) { $out = $ip_version === 'v6' && ! $v4_only - ? self::ipV6Normalize(trim($tmp[0])) - : trim($tmp[0]); + ? self::ipV6Normalize(trim($tmp[0], " \n\r\t\v\x00")) + : trim($tmp[0], " \n\r\t\v\x00"); } } } @@ -241,8 +241,8 @@ public static function ipGet($ip_type_to_get = 'real', $v4_only = true, $headers case 'x_forwarded_for': $headers = $headers ?: self::httpGetHeaders(); if (isset($headers['X-Forwarded-For'])) { - $tmp = explode(',', trim($headers['X-Forwarded-For'])); - $tmp = trim($tmp[0]); + $tmp = explode(',', trim($headers['X-Forwarded-For'], " \n\r\t\v\x00")); + $tmp = trim($tmp[0], " \n\r\t\v\x00"); $ip_version = self::ipValidate($tmp); if ($ip_version) { $out = $ip_version === 'v6' && ! $v4_only ? self::ipV6Normalize($tmp) : $tmp; @@ -254,8 +254,8 @@ public static function ipGet($ip_type_to_get = 'real', $v4_only = true, $headers case 'x_real_ip': $headers = $headers ?: self::httpGetHeaders(); if (isset($headers['X-Real-Ip'])) { - $tmp = explode(",", trim($headers['X-Real-Ip'])); - $tmp = trim($tmp[0]); + $tmp = explode(",", trim($headers['X-Real-Ip'], " \n\r\t\v\x00")); + $tmp = trim($tmp[0], " \n\r\t\v\x00"); $ip_version = self::ipValidate($tmp); if ($ip_version) { $out = $ip_version === 'v6' && ! $v4_only ? self::ipV6Normalize($tmp) : $tmp; @@ -489,7 +489,7 @@ public static function cidrValidate($cidr) */ public static function ipV6Normalize($ip) { - $ip = trim($ip); + $ip = trim($ip, " \n\r\t\v\x00"); // Searching for ::ffff:xx.xx.xx.xx patterns and turn it to IPv6 if (preg_match('/^::ffff:([0-9]{1,3}\.?){4}$/', $ip)) { $ip = dechex((int)sprintf("%u", ip2long(substr($ip, 7)))); @@ -914,7 +914,7 @@ public static function bufferTrimAndClearFromEmptyLines($buffer) { $buffer = (array)$buffer; foreach ($buffer as $indx => &$line) { - $line = trim($line); + $line = trim($line, " \n\r\t\v\x00"); if ($line === '') { unset($buffer[$indx]); } @@ -982,7 +982,7 @@ public static function bufferCsvGetMap(&$csv) */ public static function bufferCsvPopLineToArray(&$csv, $map = array()) { - $line = trim(static::bufferCsvPopLine($csv)); + $line = trim(static::bufferCsvPopLine($csv), " \n\r\t\v\x00"); $line = strpos($line, '\'') === 0 ? str_getcsv($line, ',', '\'', "\0") : explode(',', $line); diff --git a/lib/Cleantalk/Common/TextPlate.php b/lib/Cleantalk/Common/TextPlate.php index 970bafe3a..59cfc1bcd 100644 --- a/lib/Cleantalk/Common/TextPlate.php +++ b/lib/Cleantalk/Common/TextPlate.php @@ -33,7 +33,7 @@ public static function textPlateRender(string $_text, array $_plate, bool $trim { try { $search = []; - $_text = $trim ? trim($_text) : $_text; + $_text = $trim ? trim($_text, " \n\r\t\v\x00") : $_text; foreach ($_plate as $key => $value) { $key = self::validatePlateKey($key, $_text); $value = self::validatePlateValue($value, $key); diff --git a/tests/ApbctWP/ContactsEncoder/TestContactsEncoder.php b/tests/ApbctWP/ContactsEncoder/TestContactsEncoder.php index b108360a6..6d31823f9 100644 --- a/tests/ApbctWP/ContactsEncoder/TestContactsEncoder.php +++ b/tests/ApbctWP/ContactsEncoder/TestContactsEncoder.php @@ -42,7 +42,9 @@ private function clearDecoderPassedCookie(): void while ($ref) { if ($ref->hasProperty('variables')) { $prop = $ref->getProperty('variables'); - $prop->setAccessible(true); + if ( PHP_VERSION_ID < 80100 ) { + $prop->setAccessible(true); + } $variables = $prop->getValue($cookie_instance); unset($variables[$cookie_name]); $prop->setValue($cookie_instance, $variables); @@ -222,6 +224,55 @@ public function testModifyContentSkipsEmailsInsideOptionTags() $this->assertStringContainsString('apbct-email-encoder', $result); } + /** + * aria-label values must survive email encoding round-trip intact. + */ + public function testModifyContentPreservesAriaLabelWithEmail() + { + $email = 'info@example.com'; + $content = ''; + + $result = $this->contacts_encoder->modifyContent($content); + + $this->assertStringContainsString('aria-label="Contact us at ' . $email . '"', $result); + $this->assertStringNotContainsString('%%APBCT_ARIA_', $result); + $this->assertStringNotContainsString('ct_temp_aria_', $result); + } + + /** + * CVE-2026-77830: planted ct_temp_aria_0 must not be rewritten during aria-label restore. + */ + public function testModifyContentDoesNotRestorePlantedCtTempAriaToken() + { + $payload = 'test' + . 'ct_temp_aria_0' + . 'test'; + + $result = $this->contacts_encoder->modifyContent($payload); + + $this->assertStringContainsString('ct_temp_aria_0', $result); + $this->assertNotRegExp('/>\s*aria-label\s*=/', $result); + } + + /** + * CVE-2026-77830: Wordfence PoC must not produce aria-label markup breakout after encoding. + */ + public function testModifyContentWordfenceAriaLabelXssPayloadDoesNotBreakOut() + { + $payload = '
test' . "\n" + . 'ct_temp_aria_0' + . 'test'; + + $result = $this->contacts_encoder->modifyContent($payload); + + $planted_token_preserved = strpos($result, 'ct_temp_aria_0') !== false; + $breakout_injected = (bool) preg_match('/>\s*aria-label\s*=/', $result); + + $this->assertTrue($planted_token_preserved, 'Planted ct_temp_aria_0 token must survive encoder round-trip.'); + $this->assertFalse($breakout_injected, 'Encoder must not inject aria-label markup via token substitution.'); + } + public function testEncodingPhoneNumbers() { global $apbct;