Handle missing scheme in animated image rule

includes/helper-functions.php

@@ -104,7 +104,7 @@ function edac_ordinal( $number ) {
 				NumberFormatter::ORDINAL
 			)
 		)->format( $number );
-	
+
 	} else {
 		if ( $number % 100 >= 11 && $number % 100 <= 13 ) {
 			$ordinal = $number . 'th';
@@ -125,7 +125,7 @@ function edac_ordinal( $number ) {
 			}
 		}
 		return $ordinal;
-	
+
 	}
 }
 
@@ -857,3 +857,100 @@ function edac_database_table_count( $table ) {
 
 	return $count;
 }
+
+/**
+ * Add a scheme to file it looks like a url but doesn't have one.
+ *
+ * @since 1.10.1
+ *
+ * @param  string $file The filename.
+ * @param  string $site_protocol The site protocol. Default is 'https'.
+ *
+ * @return string The filename unchanged if it doesn't look like a URL, or with a scheme added if it does.
+ */
+function edac_url_add_scheme_if_not_existing( string $file, string $site_protocol = '' ): string {
+
+	// if it starts with some valid scheme return unchanged.
+	$valid_schemes = array( 'http', 'https', 'ftp', 'ftps', 'mailto', 'tel', 'file', 'data', 'irc', 'ssh', 'sftp' );
+	$start_of_file = substr( $file, 0, 6 );
+	foreach ( $valid_schemes as $scheme ) {
+		if ( str_starts_with( $start_of_file, $scheme ) ) {
+			return $file;
+		}
+	}
+
+	// if it starts with / followed by any alphanumeric assume it's a relative url.
+	if ( preg_match( '/^\/[a-zA-Z0-9]/', $file ) ) {
+		return $file;
+	}
+
+	// by this point it doesn't seem like a url or a relative path so make it into one.
+	$file_location = ltrim( $file, '/' );
+	$site_scheme   = ( ! empty( $site_protocol ) )
+		? $site_protocol
+		: ( is_ssl() ? 'https' : 'http' );
+
+	return "{$site_scheme}://{$file_location}";
+}
+
+/**
+ * Requests the headers of a URL to check if it exists.
+ *
+ * @since 1.10.1
+ *
+ * @param string $url the url to check.
+ * @return bool
+ */
+function edac_url_exists( string $url ): bool {
+
+	$response = wp_remote_head( $url );
+
+	if (
+		is_wp_error( $response ) ||
+		( // Check if the response code is not in the 2xx range.
+			wp_remote_retrieve_response_code( $response ) < 200 ||
+			wp_remote_retrieve_response_code( $response ) > 299
+		)
+	) {
+		return false;
+	}
+
+	return true;
+}
+
+/**
+ * Get a file from local or remote source as a binary file handle.
+ *
+ * @since 1.10.1
+ *
+ * @param string $filename The file location, either local or a remote URL.
+ * @return resource|bool The file binary string or false if the file could not be opened.
+ */
+function edac_get_file_opened_as_binary( string $filename ) {
+	// If the file name looks like a url without a scheme add https and check if the file exists.
+	if ( ! str_starts_with( $filename, '//' ) ) {
+		$file = $filename;
+	} else {
+		$file       = edac_url_add_scheme_if_not_existing( $filename );
+		$url_exists = edac_url_exists( $file );
+		// if the https version does not exist, try http.
+		if ( false === $url_exists ) {
+			$file       = edac_url_add_scheme_if_not_existing( $filename, 'http' );
+			$url_exists = edac_url_exists( $file );
+		}
+	}
+
+	// if this url doesn't exist, return false.
+	if ( isset( $url_exists ) && false === $url_exists ) {
+		return false;
+	}
+
+	try {
+		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_fopen, WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- path validated above.
+		$fh = fopen( $file, 'rb' );
+	} catch ( Exception $e ) {
+		return false;
+	}
+
+	return $fh;
+}

includes/rules/img_animated_gif.php

@@ -69,31 +69,14 @@ function edac_rule_img_animated_gif( $content, $post ) { // phpcs:ignore -- $pos
 }
 
 /**
- * Checks if a gif image is anaimated
+ * Checks if a gif image is animated
  *
  * @param  string $filename The filename.
  * @return bool
  */
-function edac_img_gif_is_animated( $filename ) {
+function edac_img_gif_is_animated( string $filename ): bool {
 
-	$upload_dir_info  = wp_get_upload_dir();
-	$uploads_base_dir = trailingslashit( $upload_dir_info['basedir'] );
-
-	// Get WordPress base URL and remove it from the filename to get the relative path.
-	$base_url      = trailingslashit( get_site_url() );
-	$relative_path = str_replace( $base_url, '', $filename );
-
-	// Construct the full file system path.
-	$file_system_path = $uploads_base_dir . $relative_path;
-
-	// Check if the file is within the WordPress uploads directory.
-	if ( 0 !== strpos( $file_system_path, $uploads_base_dir ) ) {
-		return false;
-	}
-
-	// First, attempt to open the file.
-	// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_fopen, WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- path validated above.
-	$fh = fopen( $filename, 'rb' );
+	$fh = edac_get_file_opened_as_binary( $filename );
 
 	// Then, check if the file handle is false, indicating an error.
 	if ( false === $fh ) {
@@ -133,24 +116,7 @@ function edac_img_gif_is_animated( $filename ) {
  */
 function edac_img_webp_is_animated( $filename ) {
 
-	$upload_dir_info  = wp_get_upload_dir();
-	$uploads_base_dir = trailingslashit( $upload_dir_info['basedir'] );
-
-	// Get WordPress base URL and remove it from the filename to get the relative path.
-	$base_url      = trailingslashit( get_site_url() );
-	$relative_path = str_replace( $base_url, '', $filename );
-
-	// Construct the full file system path.
-	$file_system_path = $uploads_base_dir . $relative_path;
-
-	// Check if the file is within the WordPress uploads directory.
-	if ( 0 !== strpos( $file_system_path, $uploads_base_dir ) ) {
-		return false;
-	}
-
-	// First, attempt to open the file.
-	// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_read_fopen, WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- path validated above.
-	$fh = fopen( $filename, 'rb' );
+	$fh = edac_get_file_opened_as_binary( $filename );
 
 	// Then, check if the file handle is false, indicating an error.
 	if ( false === $fh ) {

tests/bootstrap.php

@@ -35,3 +35,5 @@ function _manually_load_plugin() {
 
 // Start up the WP testing environment.
 require "{$_tests_dir}/includes/bootstrap.php";
+
+define( 'EDAC_TEST_ASSETS_DIR', plugin_dir_path( __FILE__ ) . 'assets/' );

tests/phpunit/helper-functions/GetFileOpenedAsBinaryTest.php

@@ -0,0 +1,41 @@
+<?php
+/**
+ * Tests the opening of image files as binary.
+ *
+ * @package Accessibility_Checker
+ */
+
+/**
+ * Tests the function that opens a file as binary - used when analyzing images.
+ *
+ * @group helper-functions
+ */
+class GetFileOpenedAsBinaryTest extends WP_UnitTestCase {
+
+	/**
+	 * Test if file gets retrieved and opened as binary.
+	 *
+	 * @group external-http
+	 */
+	public function test_file_opened_as_binary() {
+		$file = 'https://httpbin.org/image/webp';
+
+		$fh = edac_get_file_opened_as_binary( $file );
+
+		$this->assertNotFalse( $fh );
+		fclose( $fh );
+	}
+
+	/**
+	 * Test if file is not opened as binary.
+	 *
+	 * @group external-http
+	 */
+	public function test_file_not_opened_as_binary() {
+		$file = 'https://httpbin.org/status/404';
+
+		$fh = edac_get_file_opened_as_binary( $file );
+
+		$this->assertFalse( $fh );
+	}
+}

tests/phpunit/helper-functions/UrlAddSchemeIfNotExistingTest.php

@@ -0,0 +1,62 @@
+<?php
+/**
+ * Tests the helper function that adds a scheme to urls that don't have one.
+ *
+ * @package accessibility-checker
+ */
+
+/**
+ * Test class for validating the helper function that adds a scheme to urls works
+ * as it was intended when written.
+ */
+class UrlAddSchemeIfNotExistingTest extends WP_UnitTestCase {
+
+	/**
+	 * Test that the function adds a scheme to a url that doesn't have one and returns relative urls unchanged.
+	 */
+	public function test_url_add_scheme_if_not_existing() {
+		$url      = '//example.com';
+		$expected = 'https://example.com';
+		$this->assertEquals( $expected, edac_url_add_scheme_if_not_existing( $url, 'https' ) );
+
+		$url_http = '//example.com';
+		$expected = 'http://example.com';
+		$this->assertEquals( $expected, edac_url_add_scheme_if_not_existing( $url_http, 'http' ) );
+
+		$url_one_slash = '/example.com';
+		$this->assertEquals( $url_one_slash, edac_url_add_scheme_if_not_existing( $url_one_slash ) );
+
+		$url_no_slash = 'example.com';
+		$this->assertStringStartsWith( 'http', edac_url_add_scheme_if_not_existing( $url_no_slash ) );
+	}
+
+	/**
+	 * Test that the function doesn't add a scheme to a url that already has one.
+	 */
+	public function test_url_add_scheme_if_not_existing_with_scheme() {
+		$url = 'https://example.com';
+		$this->assertEquals( $url, edac_url_add_scheme_if_not_existing( $url ) );
+
+		$url_http = 'http://example.com/';
+		$this->assertEquals( $url_http, edac_url_add_scheme_if_not_existing( $url_http, 'http' ) );
+	}
+
+	/**
+	 * Test that the function doesn't add a scheme to a url that already has one, even when not http*.
+	 */
+	public function test_url_add_scheme_if_not_existing_unmoidfied_with_ftp() {
+		$ftp_url = 'ftp://example.com';
+		$this->assertEquals( $ftp_url, edac_url_add_scheme_if_not_existing( $ftp_url ) );
+	}
+
+	/**
+	 * Test that the function doesn't add a scheme to a local or relative url.
+	 */
+	public function test_url_add_scheme_if_not_existing_unmoidfied_when_local_or_relative() {
+		$local_path = '/wp-content/uploads/2024/03/image.gif';
+		$this->assertEquals( $local_path, edac_url_add_scheme_if_not_existing( $local_path ) );
+
+		$relative_url = '/about.gif';
+		$this->assertEquals( $relative_url, edac_url_add_scheme_if_not_existing( $relative_url ) );
+	}
+}

tests/phpunit/helper-functions/UrlExistsTest.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Tests the helper function that checks if a URL exists.
+ *
+ * @package accessibility-checker
+ */
+
+/**
+ * Test class for validating the helper function that checks if a URL exists.
+ */
+class UrlExistsTest extends WP_UnitTestCase {
+
+	/**
+	 * Test if URL exists.
+	 *
+	 * @group external-http
+	 */
+	public function test_url_exists() {
+		$url = 'https://httpbin.org/status/200';
+		$this->assertTrue( edac_url_exists( $url ) );
+	}
+
+	/**
+	 * Test that we get false on a non-2xx status code.
+	 *
+	 * @group external-http
+	 */
+	public function test_url_does_not_exist() {
+		$url = 'https://httpbin.org/status/404';
+		$this->assertFalse( edac_url_exists( $url ) );
+		$url = 'https://httpbin.org/status/418';
+		$this->assertFalse( edac_url_exists( $url ) );
+	}
+}