check cache exclusions input validity

build/performance/performance.min.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'react-jsx-runtime', 'wp-api-fetch', 'wp-data', 'wp-dom-ready', 'wp-element', 'wp-i18n'), 'version' => '3ac146b659c231a211d4');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'react-jsx-runtime', 'wp-api-fetch', 'wp-data', 'wp-dom-ready', 'wp-element', 'wp-i18n'), 'version' => 'a6c73cedc1573d9b2f5c');

includes/RestApi/CacheController.php

@@ -84,7 +84,17 @@ public function update_settings( \WP_REST_Request $request ) {
 
 		if ( $request->has_param( 'cacheExclusion' ) ) {
 			$cache_exclusion = $request->get_param( 'cacheExclusion' );
-			$result          = update_option( CacheExclusion::OPTION_CACHE_EXCLUSION, $cache_exclusion );
+			$validate_regex  = '/^[a-z0-9,-]+$/';
+			if ( ! preg_match( $validate_regex, $cache_exclusion ) ) {
+				return new \WP_REST_Response(
+					array(
+						'result'  => false,
+						'message' => 'Invalid cache exclusion format.',
+					),
+					400
+				);
+			}
+			$result = update_option( CacheExclusion::OPTION_CACHE_EXCLUSION, $cache_exclusion );
 		} elseif ( $request->has_param( 'cacheLevel' ) ) {
 			$cache_level = $request->get_param( 'cacheLevel' );
 			$result      = update_option( CacheManager::OPTION_CACHE_LEVEL, $cache_level );

src/sections/CacheExclusion/getCacheExclusionText.js

@@ -8,6 +8,10 @@ const getCacheExclusionText = () => ( {
 	),
 	cacheExclusionSaved: __( 'Cache Exclusion saved', 'wp-module-performance' ),
 	cacheExclusionSaveButton: __( 'Save', 'wp-module-performance' ),
+	cacheExclusionInvalidInput: __(
+		'Invalid input. Please use only lowercase letters, numbers, commas, and hyphens.',
+		'wp-module-performance'
+	),
 } );
 
 export default getCacheExclusionText;

src/sections/CacheExclusion/index.js

@@ -17,6 +17,7 @@ const {
 	cacheExclusionDescription,
 	cacheExclusionSaved,
 	cacheExclusionSaveButton,
+	cacheExclusionInvalidInput
 } = getCacheExclusionText();
 
 // Custom hook to mimic componentDidUpdate behavior
@@ -68,18 +69,28 @@ const CacheExclusion = () => {
 	};
 
 	const handleSave = () => {
+		const rules = currentValue.replace(/\s+/g, '').replace(/,$/, "");
+		const isValid = /^[a-z0-9,-]+$/.test(rules);
+
+		if ( ! isValid ) {
+			setIsError( cacheExclusionInvalidInput );
+			return;
+		}
+
 		apiFetch( {
 			url: apiUrl,
 			method: 'POST',
-			data: { cacheExclusion: currentValue },
+			data: { cacheExclusion: rules },
 		} )
 			.then( () => {
 				setIsSaved( true );
-				setCacheExclusion( currentValue );
+				setCacheExclusion( rules );
+				setCurrentValue( rules );
 				setIsEdited( false );
 			} )
 			.catch( ( error ) => {
 				setIsError( error.message );
+				setCurrentValue( rules );
 			} );
 	};
 

tests/phpunit/includes/CacheExclusionTest.php

@@ -0,0 +1,123 @@
+<?php
+// phpcs:disable
+
+namespace {
+	if ( ! class_exists( 'WP_REST_Request' ) ) {
+		class WP_REST_Request {
+			private $params = array();
+			public function __construct( $method = null, $route = '' ) {}
+			public function set_param( $k, $v ) {
+				$this->params[ $k ] = $v; }
+			public function get_param( $k = null, $d = null ) {
+				if ( $k === null ) { return $this->params;
+				}
+				return array_key_exists( $k, $this->params ) ? $this->params[ $k ] : $d;
+			}
+			public function has_param( $k ) {
+				return array_key_exists( $k, $this->params );
+			}
+			public function set_params( array $params ) {
+				$this->params = $params; }
+			public function get_params() {
+				return $this->params; }
+		}
+	}
+	if ( ! class_exists( 'WP_REST_Response' ) ) {
+		class WP_REST_Response {
+			private $data;
+			private $status;
+			public function __construct( $data = null, $status = 200 ) {
+				$this->data   = $data;
+				$this->status = $status;
+			}
+			public function get_status() {
+				return $this->status;
+			}
+			public function get_data() {
+				return $this->data;
+			}
+		}
+	}
+}
+
+namespace NewfoldLabs\WP\Module\Performance\RestApi {
+	if ( ! function_exists( __NAMESPACE__ . '\update_option' ) ) {
+		function update_option( $option, $value = null ) {
+			return \update_option( $option, $value );
+		}
+	}
+}
+
+namespace NewfoldLabs\WP\Module\Performance\Cache {
+	use WP_Mock;
+	use WP_Mock\Tools\TestCase;
+	use Patchwork;
+
+	/**
+	 * Test Cache Exclusion input value.
+	 */
+	class CacheExclusionTest extends TestCase {
+
+		/**
+		 * Set up the test environment.
+		 */
+		public function setUp(): void {
+			WP_Mock::setUp();
+			Patchwork\restoreAll(); // Ensure Patchwork starts with a clean slate.
+
+			WP_Mock::passthruFunction( '__' );
+			WP_Mock::passthruFunction( 'esc_html__' );
+		}
+
+		/**
+		 * Tear down the test environment.
+		 */
+		public function tearDown(): void {
+			WP_Mock::tearDown();
+			Patchwork\restoreAll(); // Clean up all redefined functions/constants.
+		}
+
+		/**
+		 * Test updating cache exclusion option for valid datas.
+		 */
+		public function test_update_cache_exclusion_option_valid() {
+			$valid_input = 'cart,checkout,wp-admin,wp-json,page1,page2,page-3';
+
+			$request = new \WP_REST_Request();
+			$request->set_param( 'cacheExclusion', $valid_input );
+
+			WP_Mock::userFunction(
+				'update_option',
+				array(
+					'args'   => array( \NewfoldLabs\WP\Module\Performance\Cache\CacheExclusion::OPTION_CACHE_EXCLUSION, $valid_input ),
+					'times'  => 1,
+					'return' => true,
+				)
+			);
+
+			$controller = new \NewfoldLabs\WP\Module\Performance\RestApi\CacheController();
+			$response   = $controller->update_settings( $request );
+
+			$this->assertInstanceOf( \WP_REST_Response::class, $response );
+			$this->assertSame( 200, $response->get_status() );
+			$this->assertTrue( $response->get_data()['result'] );
+		}
+		/**
+		 * Test updating cache exclusion option for invalid datas.
+		 */
+		public function test_update_cache_exclusion_option_invalid() {
+			$valid_input = 'cart,checkout,wp-admin,wp-json /membership-account* /membership-checkout* /membership-levels* /join-levels/ /login/';
+
+			$request = new \WP_REST_Request();
+			$request->set_param( 'cacheExclusion', $valid_input );
+
+			$controller = new \NewfoldLabs\WP\Module\Performance\RestApi\CacheController();
+			$response   = $controller->update_settings( $request );
+
+			$this->assertInstanceOf( \WP_REST_Response::class, $response );
+			$this->assertSame( 400, $response->get_status() );
+			$this->assertFalse( $response->get_data()['result'] );
+		}
+	}
+}
+// phpcs:enable