feat/static router by abdul-kaioum · Pull Request #15 · bit-apps-pro/wp-kit

abdul-kaioum · 2026-07-25T08:57:50Z

feat: static router to render wordpress page/post url for custom usecases
fix: route path not matching for root
fix: returning '' on the_content filter
fix: accessing property before initialized
chore: refactor. added precaution
chore: fix type
fix: namespace
Fix: static route regex
fix: chained middleware() dropped args, use array_merge

…ases

Assisted-By: AI

Internal restructure with the public API frozen (consumed by downstream plugins). Response moves to instance state behind a static facade; Router gains a type-keyed registry; route blocking uses an internal exception instead of a polled flag; response emission becomes per-transport strategies; one RoutePattern compiler serves REST/AJAX/static matching; IpTool splits into Http\\Detection\\{ClientIpResolver,UserAgent}. New collaborators: RoutePattern, MiddlewareRegistry, ResponseEnvelope, RewriteRuleSet, RouteBlockedException, MiddlewareConfigurationException, Emitter\\{ResponseEmitter,Api,Ajax,Static}ResponseEmitter. Security: HttpClient safe-by-default (wp_safe_remote_request, allowUnsafeUrls opt-in); trusted-proxy X-Forwarded-For resolution; fail-closed middleware; response header-injection validation. Adds a PHPUnit contract suite + PHPDBG coverage gate (100% on selected HTTP methods). PHP 7.4 compatible. Assisted-By: AI

Bump platform floor to PHP 8.0 (composer require + phpcs compat testVersion 8.0-). Add param/return/property type declarations and 8.0 idioms (match, str_contains, constructor promotion, null-coalescing) across src via Rector run to a fixpoint. BC-conservative at extension points: public accessors on the extendable Request (and the IpTool trait) stay untyped so consumer subclass overrides keep compiling; Arr's public helper params stay untyped to preserve arg coercion. rector.php skips these files and a Request-subclass contract test pins the untyped-override guarantee. No strict_types, no enums/readonly (would break coercion / string constants / need 8.1). Fixes surfaced during typing: HttpClient::getBoundary() assigned $this to the boundary (object-to-string fatal on multipart); ShortcodeWrapper::doShortcode() and Request::input() discarded their return values; Request::files() could return null under an array contract. Tooling: remove the lefthook hook shim; add captainhook + hook-installer with a pre-commit hook running cs-fixer (check), compat, and tests. Rewrite README into an accurate quick-start. Assisted-By: AI

fix(http): restrict unsafe requests by host

csemazharul · 2026-08-08T06:16:03Z

+        // Make case insensitive.
+        $t = strtolower($userAgent);
+
+        // If the string *starts* with the string, strpos returns 0 (i.e., FALSE). Do a ghetto hack and start with a space.
+        // "[strpos()] may return Boolean FALSE, but may also return a non-Boolean value which evaluates to FALSE."
+        //     http://php.net/manual/en/function.strpos.php
+        $t = ' ' . $t;
+
+        // Humans / Regular Users
+        if (strpos($t, 'opera') || strpos($t, 'opr/')) {
+            return 'Opera';
+        }
+
+        if (strpos($t, 'edge')) {
+            return 'Edge';
+        }
+
+        if (strpos($t, 'Edg')) {
+            return 'Edge';
+        }
+
+        if (strpos($t, 'chrome')) {
+            return 'Chrome';
+        }
+
+        if (strpos($t, 'safari')) {
+            return 'Safari';
+        }
+
+        if (strpos($t, 'firefox')) {
+            return 'Firefox';
+        }
+
+        if (strpos($t, 'msie') || strpos($t, 'trident/7')) {
+            return 'Internet Explorer';
+        }
+
+        if (strpos($t, 'google')) {
+            return 'Googlebot';
+        }
+
+        if (strpos($t, 'bing')) {
+            return 'Bingbot';
+        }
+
+        if (strpos($t, 'slurp')) {
+            return 'Yahoo! Slurp';
+        }
+
+        if (strpos($t, 'duckduckgo')) {
+            return 'DuckDuckBot';
+        }
+
+        if (strpos($t, 'baidu')) {
+            return 'Baidu';
+        }
+
+        if (strpos($t, 'yandex')) {
+            return 'Yandex';
+        }
+
+        if (strpos($t, 'sogou')) {
+            return 'Sogou';
+        }
+
+        if (strpos($t, 'exabot')) {
+            return 'Exabot';
+        }
+
+        if (strpos($t, 'msn')) {
+            return 'MSN';
+        }
+
+        // Common Tools and Bots
+        if (strpos($t, 'mj12bot')) {
+            return 'Majestic';
+        }
+
+        if (strpos($t, 'ahrefs')) {
+            return 'Ahrefs';
+        }
+
+        if (strpos($t, 'semrush')) {
+            return 'SEMRush';
+        }
+
+        if (strpos($t, 'rogerbot') || strpos($t, 'dotbot')) {
+            return 'Moz';
+        }
+
+        if (strpos($t, 'frog') || strpos($t, 'screaming')) {
+            return 'Screaming Frog';
+        }
+
+        if (strpos($t, 'facebook')) {
+            return 'Facebook';
+        }
+
+        if (strpos($t, 'pinterest')) {
+            return 'Pinterest';
+        }
+
+        if (
+            strpos($t, 'crawler')
+            || strpos($t, 'api')
+            || strpos($t, 'spider')
+            || strpos($t, 'http')
+            || strpos($t, 'bot')
+            || strpos($t, 'archive')
+            || strpos($t, 'info')
+            || strpos($t, 'data')
+        ) {
+            return 'Bot';
+        }
+
+        return 'Other (Unknown)';
+    }


It will be better to use the match function instead of if

good catch. Need to upgrade php 8

Refactored browser and bot detection to ordered token tables. This preserves priority, removes the legacy conditional chain, and covers modern Edg/ before Chrome; match(true) would still require the same ordering and would not address the original case-normalization defect.

csemazharul · 2026-08-08T06:18:04Z

    public function input($offset, $default = null)
    {
-        $this->get($offset, $default);
+        return $this->get($offset, $default);
    }



Missing return type.

Intentionally left Request::input() untyped for downstream subclass compatibility. Existing consumers override this extension point with legacy signatures; adding a return type would cause inheritance fatals. The compatibility test and Rector skip document this frozen contract.

csemazharul · 2026-08-08T06:39:52Z

+                add_filter('the_content', [$this, 'renderContent']);
+
+                $this->content = $route->handleRequest();
+


It will be a fatal error if the handleRequest method returns Array or null.

Fixed with an explicit static-page contract: null renders empty content, scalar/Stringable values normalize to strings, arrays throw a clear UnexpectedValueException, and denied/error responses never enter HTML emission. Custom/direct route transports retain raw array output for backward compatibility.

abdul-kaioum · 2026-08-08T07:43:02Z

Hardening/refactor update pushed in de476c9.

Implemented:

complete literal/optional static rewrites and all-rule persistence checks
static HTTP-method enforcement and string-compatible page output
falsey route parameter/default preservation
fresh Response factory state and atomic header validation
OPTIONS/query composition and standards-compliant, injection-safe multipart handling
modern Edge and warning-free User-Agent classification
PHP 8.0-compatible PHPUnit/tooling plus PHP 8.0/8.4/8.5 CI

Verification:

195 tests, 387 assertions
selected HTTP coverage 100% (197/197)
Composer validate/audit, PHPCompatibility, lint, Rector, and diff checks pass
vuln-scan: no unsafe SQL sink matches; remaining leads triaged as framework/test heuristics

Request::input() remains deliberately untyped to preserve downstream subclass compatibility. The PR has not been merged.

abdul-kaioum and others added 9 commits July 25, 2026 14:56

feat: static router to render wordpress page/post url for custom usec…

5a2dd92

…ases

fix: route path not matching for root

a9c755c

fix: returning '' on the_content filter

3ef5665

fix: accessing property before initialized

4fa5b17

chore: refactor. added precaution

39af6d5

chore: fix type

c91bd89

fix: namespace

377dd23

Fix: static route regex

4c350cc

fix: chained middleware() dropped args, use array_merge

f27a354

Assisted-By: AI

abdul-kaioum requested review from csemazharul and shuvomohajan July 25, 2026 08:58

abdul-kaioum and others added 7 commits July 29, 2026 13:17

feat: configure unsafe HTTP host allowlist

906ed71

fix: restrict unsafe HTTP requests by host

f2b28b7

docs: explain private HTTP host authorization

8e8ca27

fix: reset HTTP response state on rejection

a4599cb

Merge pull request #16 from bit-apps-pro/security/http-ssrf-hardening

2c928d9

fix(http): restrict unsafe requests by host

csemazharul requested changes Aug 8, 2026

View reviewed changes

abdul-kaioum added 9 commits August 8, 2026 13:41

build: align test tooling with PHP 8

3a221dc

fix(router): compile complete static rewrites

636eccc

fix(router): enforce static dispatch contract

9eda702

fix(router): preserve falsey route parameters

e7e0053

fix(http): isolate response lifecycle state

15649cd

fix(http): build valid multipart requests

514905b

refactor(http): simplify client detection

a45032e

docs: document hardened HTTP contracts

7eb43e0

fix(http): close review edge cases

de476c9

test: support private reflection on PHP 8

221a5c4

Navigation Menu

Uh oh!

feat/static router - #15

feat/static router#15
abdul-kaioum wants to merge 26 commits into
mainfrom
feat/static-router

abdul-kaioum commented Jul 25, 2026

Uh oh!

csemazharul Aug 8, 2026

Uh oh!

abdul-kaioum Aug 8, 2026

Uh oh!

abdul-kaioum Aug 8, 2026

Uh oh!

csemazharul Aug 8, 2026

Uh oh!

abdul-kaioum Aug 8, 2026

Uh oh!

csemazharul Aug 8, 2026

Uh oh!

abdul-kaioum Aug 8, 2026

Uh oh!

abdul-kaioum commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		add_filter('the_content', [$this, 'renderContent']);

		$this->content = $route->handleRequest();

Uh oh!

Conversation

abdul-kaioum commented Jul 25, 2026

Uh oh!

csemazharul Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

abdul-kaioum Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

abdul-kaioum Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

csemazharul Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

abdul-kaioum Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

csemazharul Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

abdul-kaioum Aug 8, 2026

Choose a reason for hiding this comment

Uh oh!

abdul-kaioum commented Aug 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants