Upgrades: Add routine that fixes Follower json (#1383)

* Upgrades: Add routine that fixes Follower json

* Slashed function calls

* Fix merge mishaps.

Props @github.

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+* Upgrade script to fix Follower json representations with unescaped backslashes.
+
 ### Changed
 
 * Bumped minimum required WordPress version to 6.4.

includes/class-migration.php

@@ -186,6 +186,7 @@ public static function maybe_migrate() {
 			add_action( 'init', 'flush_rewrite_rules', 20 );
 		}
 		if ( \version_compare( $version_from_db, 'unreleased', '<' ) ) {
+			\wp_schedule_single_event( \time(), 'activitypub_upgrade', array( 'update_actor_json_slashing' ) );
 			\wp_schedule_single_event( \time(), 'activitypub_upgrade', array( 'update_comment_author_emails' ) );
 		}
 
@@ -635,6 +636,50 @@ public static function create_comment_outbox_items( $batch_size = 50, $offset =
 		return null;
 	}
 
+	/**
+	 * Update _activitypub_actor_json meta values to ensure they are properly slashed.
+	 *
+	 * @param int $batch_size Optional. Number of meta values to process per batch. Default 100.
+	 * @param int $offset     Optional. Number of meta values to skip. Default 0.
+	 * @return array|null Array with batch size and offset if there are more meta values to process, null otherwise.
+	 */
+	public static function update_actor_json_slashing( $batch_size = 100, $offset = 0 ) {
+		global $wpdb;
+
+		// phpcs:ignore WordPress.DB.DirectDatabaseQuery
+		$meta_values = $wpdb->get_results(
+			$wpdb->prepare(
+				"SELECT post_id, meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_activitypub_actor_json' LIMIT %d OFFSET %d",
+				$batch_size,
+				$offset
+			)
+		);
+
+		foreach ( $meta_values as $meta ) {
+			$json = \json_decode( $meta->meta_value, true );
+
+			// If json_decode fails, try adding slashes.
+			if ( null === $json && \json_last_error() !== JSON_ERROR_NONE ) {
+				$escaped_value = \preg_replace( '#\\\\(?!["\\\\/bfnrtu])#', '\\\\\\\\', $meta->meta_value );
+				$json          = \json_decode( $escaped_value, true );
+
+				// Update the meta if json_decode succeeds with slashes.
+				if ( null !== $json && \json_last_error() === JSON_ERROR_NONE ) {
+					\update_post_meta( $meta->post_id, '_activitypub_actor_json', \wp_slash( $escaped_value ) );
+				}
+			}
+		}
+
+		if ( \count( $meta_values ) === $batch_size ) {
+			return array(
+				'batch_size' => $batch_size,
+				'offset'     => $offset + $batch_size,
+			);
+		}
+
+		return null;
+	}
+
 	/**
 	 * Update comment author emails with webfinger addresses for ActivityPub comments.
 	 *

readme.txt

@@ -131,6 +131,7 @@ For reasons of data protection, it is not possible to see the followers of other
 
 = Unreleased =
 
+* Added: Upgrade script to fix Follower json representations with unescaped backslashes.
 * Changed: Bumped minimum required WordPress version to 6.4.
 * Changed: Use a later hook for Posts to get published to the Outbox, to get sure all `post_meta`s and `taxonomy`s are set stored properly.
 * Changed: Use webfinger as author email for comments from the Fediverse.

tests/includes/class-test-migration.php

@@ -7,9 +7,11 @@
 
 namespace Activitypub\Tests;
 
+use Activitypub\Collection\Followers;
 use Activitypub\Collection\Outbox;
 use Activitypub\Migration;
 use Activitypub\Comment;
+use Activitypub\Model\Follower;
 
 /**
  * Test class for Activitypub Migrate.
@@ -598,6 +600,45 @@ public function test_create_comment_outbox_items_batching() {
 		$this->assertNull( $result );
 	}
 
+	/**
+	 * Test update_actor_json_slashing updates unslashed meta values.
+	 *
+	 * @covers ::update_actor_json_slashing
+	 */
+	public function test_update_actor_json_slashing() {
+		$follower = new Follower();
+		$follower->from_array(
+			array(
+				'type'    => 'Person',
+				'summary' => '<p>unescaped backslash 04\2024</p>',
+			)
+		);
+		$unslashed_json = $follower->to_json();
+
+		$post_id = self::factory()->post->create(
+			array(
+				'post_type'  => Followers::POST_TYPE,
+				'meta_input' => array( '_activitypub_actor_json' => $unslashed_json ),
+			)
+		);
+
+		$original_meta = \get_post_meta( $post_id, '_activitypub_actor_json', true );
+		$this->assertNull( \json_decode( $original_meta, true ) );
+		$this->assertEquals( JSON_ERROR_SYNTAX, \json_last_error() );
+
+		$result = Migration::update_actor_json_slashing();
+
+		// No additional batch should be scheduled.
+		$this->assertNull( $result );
+
+		$updated_meta = \get_post_meta( $post_id, '_activitypub_actor_json', true );
+
+		// Verify the updated value can be successfully decoded.
+		$decoded = \json_decode( $updated_meta, true );
+		$this->assertNotNull( $decoded, 'Updated meta should be valid JSON' );
+		$this->assertEquals( JSON_ERROR_NONE, \json_last_error() );
+	}
+
 	/**
 	 * Test update_comment_author_emails updates emails with webfinger addresses.
 	 *