Repository navigation
A database password with a quote or a backslash breaks wp-tests-config.php #354
Description
prepare.php writes WPT_DB_NAME, WPT_DB_USER, WPT_DB_PASSWORD and WPT_DB_HOST into single-quoted PHP strings in wp-tests-config.php without escaping them.
I ran the config-writing code of prepare.php on master (61491cb) with a few passwords:
WPT_DB_PASSWORD |
Result in wp-tests-config.php |
|---|---|
p'q"r$s#t u |
Parse error on line 42 |
endswith\ |
Parse error on line 43 |
two\\back |
No error, but DB_PASSWORD is two\back |
my-localhost-pw |
No error, but DB_PASSWORD is my-127.0.0.1:33348-pw |
The last one happens because the placeholders are replaced one after another with str_replace(), so the localhost placeholder also matches inside the password that was written a step earlier.
The same escaping problem applies to WPT_TABLE_PREFIX, which is written into $table_prefix in the generated config.
With the parse error, the test run fails, and cleanup-db.php cannot read the settings, so the test tables stay in the database. Randomly generated passwords can contain these characters.
WordPress escapes these values with addcslashes( $value, "\\'" ) when it writes wp-config.php in wp-admin/setup-config.php. I have a fix with a CI check and will open a pull request.
Activity