Escape path prefix and restrict it to be a pathname in Speculation Rules

modules/js-and-css/speculation-rules/class-plsr-url-pattern-prefixer.php

@@ -31,7 +31,12 @@ class PLSR_URL_Pattern_Prefixer {
 	 */
 	public function __construct( array $contexts = array() ) {
 		if ( $contexts ) {
-			$this->contexts = array_map( 'trailingslashit', $contexts );
+			$this->contexts = array_map(
+				static function ( string $str ): string {
+					return self::escape_pattern_string( trailingslashit( $str ) );
+				},
+				$contexts
+			);
 		} else {
 			$this->contexts = self::get_default_contexts();
 		}
@@ -69,12 +74,23 @@ public function prefix_path_pattern( string $path_pattern, string $context = 'ho
 			return $path_pattern;
 		}
 
-		// If the path already starts with the context path (including '/'), there is nothing to prefix.
-		if ( str_starts_with( $path_pattern, $this->contexts[ $context ] ) ) {
-			return $path_pattern;
+		// In the event that the context path contains a :, ? or # (which can cause the URL pattern parser to
+		// switch to another state, though only the latter two should be percent encoded anyway), we need to
+		// additionally enclose it in grouping braces. The final forward slash (trailingslashit ensures there is
+		// one) affects the meaning of the * wildcard, so is left outside the braces.
+		$context_path         = $this->contexts[ $context ];
+		$escaped_context_path = $context_path;
+		if ( strcspn( $context_path, ':?#' ) !== strlen( $context_path ) ) {
+			$escaped_context_path = '{' . substr( $context_path, 0, -1 ) . '}/';
+		}
+
+		// If the path already starts with the context path (including '/'), remove it first
+		// since it is about to be added back.
+		if ( str_starts_with( $path_pattern, $context_path ) ) {
+			$path_pattern = substr( $path_pattern, strlen( $context_path ) );
 		}
 
-		return $this->contexts[ $context ] . ltrim( $path_pattern, '/' );
+		return $escaped_context_path . ltrim( $path_pattern, '/' );
 	}
 
 	/**
@@ -86,8 +102,32 @@ public function prefix_path_pattern( string $path_pattern, string $context = 'ho
 	 */
 	public static function get_default_contexts(): array {
 		return array(
-			'home' => trailingslashit( wp_parse_url( home_url( '/' ), PHP_URL_PATH ) ),
-			'site' => trailingslashit( wp_parse_url( site_url( '/' ), PHP_URL_PATH ) ),
+			'home' => self::escape_pattern_string( trailingslashit( wp_parse_url( home_url( '/' ), PHP_URL_PATH ) ) ),
+			'site' => self::escape_pattern_string( trailingslashit( wp_parse_url( site_url( '/' ), PHP_URL_PATH ) ) ),
+		);
+	}
+
+	/**
+	 * Escapes a string for use in a URL pattern component.
+	 * https://urlpattern.spec.whatwg.org/#escape-a-pattern-string
+	 *
+	 * @since n.e.x.t
+	 *
+	 * @param string $str String to be escaped.
+	 * @return string String with backslashes added where required.
+	 */
+	private static function escape_pattern_string( string $str ): string {
+		$replacements = array(
+			'+'  => '\\+',
+			'*'  => '\\*',
+			'?'  => '\\?',
+			':'  => '\\:',
+			'{'  => '\\{',
+			'}'  => '\\}',
+			'('  => '\\(',
+			')'  => '\\)',
+			'\\' => '\\\\',
 		);
+		return strtr( $str, $replacements );
 	}
 }

tests/modules/js-and-css/speculation-rules/plsr-url-pattern-prefixer-test.php

@@ -33,6 +33,8 @@ public function data_prefix_path_pattern() {
 			// Missing trailing slash still works, does not consider "cut-off" directory names.
 			array( '/subdir', '/subdirectory/my-page/', '/subdir/subdirectory/my-page/' ),
 			array( '/subdir', 'subdirectory/my-page/', '/subdir/subdirectory/my-page/' ),
+			// A base path containing a : must be enclosed in braces to avoid confusion.
+			array( '/scope:0/', '/*/foo', '{/scope\\:0}/*/foo' ),
 		);
 	}
 
@@ -45,25 +47,30 @@ public function test_get_default_contexts() {
 		$this->assertSame( '/', $contexts['site'] );
 	}
 
-	public function test_get_default_contexts_with_subdirectories() {
-		add_filter(
-			'home_url',
-			static function () {
-				return 'https://example.com/subdir/';
-			}
-		);
+	/**
+	 * @dataProvider data_default_contexts_with_subdirectories
+	 */
+	public function test_get_default_contexts_with_subdirectories( $context, $unescaped, $expected ) {
 		add_filter(
-			'site_url',
-			static function () {
-				return 'https://example.com/subdir/wp/';
+			$context . '_url',
+			static function () use ( $unescaped ) {
+				return $unescaped;
 			}
 		);
 
 		$contexts = PLSR_URL_Pattern_Prefixer::get_default_contexts();
 
-		$this->assertArrayHasKey( 'home', $contexts );
-		$this->assertArrayHasKey( 'site', $contexts );
-		$this->assertSame( '/subdir/', $contexts['home'] );
-		$this->assertSame( '/subdir/wp/', $contexts['site'] );
+		$this->assertArrayHasKey( $context, $contexts );
+		$this->assertSame( $expected, $contexts[ $context ] );
+	}
+
+	public function data_default_contexts_with_subdirectories() {
+		return array(
+			array( 'home', 'https://example.com/subdir/', '/subdir/' ),
+			array( 'site', 'https://example.com/subdir/wp/', '/subdir/wp/' ),
+			// If the context URL has URL pattern special characters it may need escaping.
+			array( 'home', 'https://example.com/scope:0.*/', '/scope\\:0.\\*/' ),
+			array( 'site', 'https://example.com/scope:0.*/wp+/', '/scope\\:0.\\*/wp\\+/' ),
+		);
 	}
 }