Emoji: First pass at support in Interactions #1129

obenland · 2025-01-07T17:32:41Z

Fixes #970.

See https://mas.to/@obietester/115741669531612641
See https://obietester.blog/2025/12/02/battery-powered-tools-vs-air-compressor-tools-a-comprehensive-comparison/#comment-1946

Proposed changes:

Adds callback function that replaces custom emoji strings with their image representations when available.
Adds unit test to cover the new function.
Runs author name and comment content through the new callback on insert and update.

Other information:

Have you written new tests for your changes, if applicable?

Testing instructions:

Go to Mastodon, for example, and reply to a federated test post with a custom emoji. :yikes:, :AngeryCat:, etc.
Go to the comment list in wp-admin and make sure the emoji render as images.

pfefferle · 2025-01-10T10:29:26Z

I think before allowing images in comments, we have to think about/implement a proper blocking and moderation tooling (even more if it is about side-loading images): https://www.theverge.com/2023/7/24/23806093/mastodon-csam-study-decentralized-network

obenland · 2025-01-10T19:39:35Z

I just pushed an update that moves the replacement into a filter that runs after comment_content and the author have been sanitized. That way, only custom emoji images will be added to the content.

jeherve · 2025-01-13T11:06:25Z

Heads up: This PR adds img tags to the list of allowed HTML tags for Interactions!

Would sideloading the image onto the site with media_sideload_image be helpful here?

It would ensure the images remain available in the future.
It would avoid image hotlinking, which can be frowned upon.
It would add some validation to the image data before to simply display it on the site.

Of course, we'd need to be okay adding potentially a lot of new media to a site once that's enabled. I'm not sure that's okay.

obenland · 2025-01-13T17:13:44Z

It would avoid image hotlinking, which can be frowned upon.

With custom emoji being shared tags, is that not kind of expected?

jeherve · 2025-01-14T14:48:45Z

With custom emoji being shared tags, is that not kind of expected?

I'm honestly not sure what the common practice is with other Fediverse software. From what I can tell, on Mastodon and on GoToSocial the images from remote instances seem to be cached on the local server:

GoToSocial:

Mastodon

obenland · 2025-06-09T19:16:50Z

@Jiwoon-Kim I appreciate your input and feedback, but comments and issues of this length are not helpful. They generally lack a specific ask or suggestion and are incredibly hard to read. Going forward, please keep comments/issues concise and actionable, like I asked for previously.

obenland · 2025-06-10T13:19:56Z

I do understand, maybe part of your workflow could be to instruct your LLM to use natural language and distill its response to a sentence or two?

Jiwoon-Kim · 2025-08-24T09:18:15Z

https://developer.wordpress.org/news/2025/08/registering-custom-social-icons-in-wordpress-6-9/

Jiwoon-Kim · 2025-09-30T08:28:17Z

obenland · 2025-10-02T20:49:41Z

Todo:

Store emoji files for comment authors on comment save.
Update replacement with using attachment

Jiwoon-Kim · 2025-10-25T12:03:52Z

It’s possible to display custom emojis from remote instances by extending the Smiley feature.
See: https://wordpress.org/documentation/article/what-are-smilies/#where-are-my-smiley-images-kept

#2371

Replace multiple database queries with single batched query and fast lookup arrays. This eliminates N+1 query problem where each emoji required separate database calls. Changes: - Single get_posts() query instead of one per emoji - Fast O(1) lookup arrays instead of O(n) loops - Consolidated meta query building into single loop - Removed redundant array collections

Instead of storing HTML markup in the comment_author field, now stores the shortcode (e.g., ":emoji:") and replaces it on display. This makes the implementation more future-proof: - If the plugin is disabled, shortcodes display gracefully - Emoji images can be updated dynamically - Database stays clean without HTML markup Implementation: - Store ActivityPub emoji tag data in comment meta - Use get_comment_author filter to replace shortcodes with img tags - Use comment_author filter to selectively unescape only emoji images - Maintain WordPress security by only unescaping known emoji markup

- Add import_emoji() method to Attachments class for downloading and caching emoji images - Store emoji files organized by source domain: /activitypub/emoji/{domain}/ - Simplify Emoji class from 225 lines to 89 lines by delegating storage to Attachments - Remove WordPress attachment posts for emoji, use lightweight file storage instead - Add img tag to allowed HTML in comments for emoji support - Fix comment_author to store shortcodes (replaced at display time, not save time)

- Add prepare_comment_data() for content emoji replacement at insert-time - Add prepare_actor_meta() for storing emoji data on remote actors - Add replace_from_json() for display-time emoji replacement - Store emoji on remote actors instead of duplicating in comment meta - Look up author emoji from linked remote actor at display time - Remove redundant pre_comment_content filters from Interactions

- Add get_emoji_tags() to filter only Emoji-type tags - Store filtered emoji tags instead of entire tag array - Use to_json() and to_array() while filters are removed

- Add accessibility attributes to emoji img tags (width, height, title, draggable) - Add CSS for reduced-motion preference to pause animated emoji - Update allowed HTML attributes for emoji in comments - Add cache invalidation via filemtime for emoji with updated timestamps - Add emoji support for actor names and descriptions in follower emails - Add tests for emoji cache invalidation behavior

- Use correct method Remote_Actors::get_by_uri() instead of get_by_actor() - Update test assertions to check for locally cached emoji URLs

Extracts emoji data from stored actor JSON and saves it as _activitypub_emoji post meta, enabling display-time emoji replacement for comments from actors that were stored before emoji support was added.

Mastodon sends emoji names in lowercase in tags but may use different casing in the content (e.g., :KannaWave: vs :kannawave:). Changed str_replace to str_ireplace for case-insensitive matching. Added comprehensive unit tests for the Emoji class covering multiple emoji, repeated emoji, adjacent emoji, and case-insensitive replacement.

Use wp_add_inline_style to add emoji float fix only on edit-comments.php, attached to wp-emoji-styles handle. Removes unused CSS from admin stylesheet.

obenland · 2025-12-18T17:11:28Z

@pfefferle Might need some testing, but should be close now.

See https://mas.to/@obietester/115741669531612641
See https://obietester.blog/2025/12/02/battery-powered-tools-vs-air-compressor-tools-a-comprehensive-comparison/#comment-1946

…dpress-activitypub into add/emoji-support

Copilot

Pull request overview

This PR implements custom emoji support for ActivityPub interactions, enabling custom emoji from federated sources (like Mastodon) to be displayed as images in WordPress comments. The implementation caches emoji images locally, stores emoji metadata with remote actors, and provides display-time rendering for author names while processing emoji in comment content at insert-time.

Key Changes

Adds new Emoji class to handle custom emoji replacement with image tags
Implements emoji caching system that downloads and stores emoji files organized by domain
Adds migration to extract and store emoji metadata from existing remote actors

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 18 comments.

Show a summary per file

File	Description
includes/class-emoji.php	New class providing emoji processing, replacement, and metadata extraction functionality
includes/class-attachments.php	Adds emoji import/caching with timestamp-based refresh logic
includes/collection/class-interactions.php	Integrates emoji processing into comment creation/updates and allows img tags in comments
includes/class-comment.php	Adds filters to render emoji in author names at display-time
includes/collection/class-remote-actors.php	Stores emoji metadata when upserting remote actors
includes/class-migration.php	Adds batch migration to populate emoji metadata for existing actors
includes/class-mailer.php	Applies emoji replacement in email notifications
includes/wp-admin/class-admin.php	Adds CSS to prevent emoji float in comment author column
tests/phpunit/tests/includes/class-test-emoji.php	Comprehensive test suite for emoji functionality
tests/phpunit/tests/includes/class-test-interactions.php	Adds integration test for emoji in comments
tests/phpunit/tests/includes/class-test-migration.php	Tests emoji migration batching and data extraction
tests/phpunit/tests/includes/class-test-attachments.php	Tests emoji import, caching, and refresh logic

Comments suppressed due to low confidence (1)

includes/class-attachments.php:184

The emoji import accepts any valid URL without checking if it's an image file. While download_url will fetch any URL, consider validating that the URL path ends with a recognized image extension (.png, .jpg, .jpeg, .gif, .webp) or checking the Content-Type header after download to prevent non-image files from being cached in the emoji directory.

	public static function import_emoji( $emoji_url, $updated = null ) {
		if ( empty( $emoji_url ) || ! \filter_var( $emoji_url, FILTER_VALIDATE_URL ) ) {
			return false;
		}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/phpunit/tests/includes/class-test-attachments.php

includes/class-attachments.php

includes/class-mailer.php

includes/collection/class-interactions.php

includes/class-emoji.php

includes/class-attachments.php

includes/class-comment.php

includes/class-migration.php

includes/class-emoji.php

includes/class-attachments.php

- Validate emoji downloads are actual images using wp_get_image_mime() - Handle wp_mkdir_p() failure by cleaning up temp file - Use glob for timestamp comparison to handle webp-optimized files - Add unslash/re-slash in prepare_comment_data() to avoid escaping img attributes - Add test for download failure handling

- Add Emoji::get_kses_allowed_html() with strict validation: - Requires class="emoji" attribute - Validates src URL points to local emoji uploads directory - Requires standard emoji dimensions (20x20) - Update Interactions::allowed_comment_html() to use strict KSES - Update Comment::unescape_emoji() to use strict KSES - Only replace emoji shortcodes when local import succeeds - Add activitypub_pre_import_emoji filter for test mocking - Non-emoji img tags are now stripped from incoming content

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

includes/class-mailer.php

includes/class-migration.php

includes/class-attachments.php

includes/class-emoji.php

Copilot · 2025-12-19T13:38:19Z

includes/class-emoji.php

+		foreach ( $emoji_data as $emoji ) {
+			$local_url = Attachments::import_emoji( $emoji['url'], $emoji['updated'] ?? null );
+
+			// Only replace if the emoji was successfully uploaded locally.
+			if ( $local_url ) {
+				$text = self::replace_emoji_in_text( $text, $emoji['name'], $local_url );
+			}
+		}


Performance concern: Emoji images are imported one by one in a loop, with each import potentially making an HTTP request to download the emoji. For comments with many emojis, this could result in multiple sequential HTTP requests. Consider implementing batch download or parallel processing of emoji imports to reduce latency when processing comments with multiple emojis.

includes/class-attachments.php

Verifies that sanitize_file_name() prevents glob patterns like [abc].png, test*.png, tes?.png, and {foo,bar}.png from matching unintended cached files.

@param

- Add missing @param tags for data provider test - Add emoji import mock to interactions test for KSES validation

obenland requested review from a team and jeherve January 7, 2025 17:32

obenland self-assigned this Jan 7, 2025

github-actions bot added the [Feature] Collections label Jan 7, 2025

obenland force-pushed the add/emoji-support branch from 76f5d33 to 47a6493 Compare February 19, 2025 22:04

obenland marked this pull request as draft February 19, 2025 23:26

This comment was marked as outdated.

Sign in to view

This comment was marked as off-topic.

Sign in to view

Jiwoon-Kim mentioned this pull request Jun 10, 2025

Related to Emoji rendering and interaction #1797

Closed

This comment was marked as outdated.

Sign in to view

Jiwoon-Kim mentioned this pull request Jul 1, 2025

Federated comments: images attached to mention are not saved in local comment #1852

Open

This comment was marked as outdated.

Sign in to view

github-actions bot added the [Status] In Progress label Sep 11, 2025

obenland force-pushed the add/emoji-support branch from 51eeb14 to ffbce79 Compare September 11, 2025 20:08

obenland added 5 commits December 18, 2025 08:08

Emoji: First pass at support in Interactions

25ae06b

Process emoji after sanitization

e436e64

Save emoji images to media library

27fed14

Fix emoji display in wp-admin

4e1ff43

obenland force-pushed the add/emoji-support branch from c956b33 to 55e986c Compare December 18, 2025 14:27

github-actions bot added the [Tests] Includes Tests label Dec 18, 2025

obenland added 5 commits December 18, 2025 08:29

Remove merge conflict remnant

830c142

Store only emoji tags in actor meta

b82cb7e

- Add get_emoji_tags() to filter only Emoji-type tags - Store filtered emoji tags instead of entire tag array - Use to_json() and to_array() while filters are removed

github-actions bot added the [Feature] Notifications label Dec 18, 2025

obenland added 4 commits December 18, 2025 10:11

Fix emoji method name and test assertions

6645fdc

- Use correct method Remote_Actors::get_by_uri() instead of get_by_actor() - Update test assertions to check for locally cached emoji URLs

Add migration to populate emoji meta for existing remote actors

61431cb

Extracts emoji data from stored actor JSON and saves it as _activitypub_emoji post meta, enabling display-time emoji replacement for comments from actors that were stored before emoji support was added.

Move emoji CSS to inline style on comments screen

c4405a5

Use wp_add_inline_style to add emoji float fix only on edit-comments.php, attached to wp-emoji-styles handle. Removes unused CSS from admin stylesheet.

github-actions bot added the [Feature] WP Admin label Dec 18, 2025

obenland marked this pull request as ready for review December 18, 2025 17:10

Merge branch 'trunk' into add/emoji-support

e1e5772

Copilot AI review requested due to automatic review settings December 18, 2025 17:10

Copilot started reviewing on behalf of obenland December 18, 2025 17:10 View session

obenland added 2 commits December 18, 2025 11:13

Add changelog entry

f80a3ae

Merge branch 'add/emoji-support' of https://github.com/Automattic/wor…

1e4f854

…dpress-activitypub into add/emoji-support

Copilot AI reviewed Dec 18, 2025

View reviewed changes

obenland added 2 commits December 18, 2025 14:52

obenland requested a review from Copilot December 19, 2025 13:28

Copilot started reviewing on behalf of obenland December 19, 2025 13:28 View session

Copilot AI reviewed Dec 19, 2025

View reviewed changes

obenland added 3 commits December 21, 2025 11:16

Add tests for glob metacharacter sanitization in emoji URLs

7faae09

Verifies that sanitize_file_name() prevents glob patterns like [abc].png, test*.png, tes?.png, and {foo,bar}.png from matching unintended cached files.

Fix test docblocks and add emoji import mock

48f4022

- Add missing @param tags for data provider test - Add emoji import mock to interactions test for KSES validation

Merge branch 'trunk' into add/emoji-support

9f16d67

Emoji: First pass at support in Interactions #1129

Are you sure you want to change the base?

Emoji: First pass at support in Interactions #1129

Uh oh!

Conversation

obenland commented Jan 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes:

Other information:

Testing instructions:

Uh oh!

pfefferle commented Jan 10, 2025

Uh oh!

obenland commented Jan 10, 2025

Uh oh!

jeherve commented Jan 13, 2025

Uh oh!

obenland commented Jan 13, 2025

Uh oh!

jeherve commented Jan 14, 2025

Uh oh!

This comment was marked as outdated.

obenland commented Jun 9, 2025

Uh oh!

This comment was marked as off-topic.

obenland commented Jun 10, 2025

Uh oh!

This comment was marked as outdated.

Jiwoon-Kim commented Aug 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Jiwoon-Kim commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

obenland commented Oct 2, 2025

Uh oh!

Jiwoon-Kim commented Oct 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

obenland commented Dec 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

obenland commented Jan 7, 2025 •

edited

Loading

Jiwoon-Kim commented Aug 24, 2025 •

edited

Loading

Jiwoon-Kim commented Sep 30, 2025 •

edited

Loading

Jiwoon-Kim commented Oct 25, 2025 •

edited

Loading