Fixes

Author: PDowney

SECURITY.md

@@ -25,7 +25,7 @@ We will acknowledge your report within 5 business days and work with you to reso
 
 ## Security Best Practices
 
-- Keep your WordPress installation and dependencies up to date, unless a managed deployment process requires approval first.
+- Keep your WordPress installation and dependencies up to date. If a managed deployment process requires approval, prioritize security updates and apply them promptly after approval.
 - Use strong, unique passwords for all accounts.
 - Restrict SSH and admin access to trusted IPs.
 - Regularly back up your data.

tests/bootstrap.php

@@ -308,8 +308,25 @@ function esc_html__( string $text ): string {
 if ( ! function_exists( 'add_settings_error' ) ) {
 	/**
 	 * Register a settings error.
+	 *
+	 * @param string $setting Setting slug.
+	 * @param string $code    Error code.
+	 * @param string $message Error message.
+	 * @param string $type    Error type.
 	 */
-	function add_settings_error(): void {
+	function add_settings_error( string $setting, string $code, string $message, string $type = 'error' ): void {
+		global $wp_settings_errors;
+
+		if ( ! is_array( $wp_settings_errors ) ) {
+			$wp_settings_errors = array();
+		}
+
+		$wp_settings_errors[] = array(
+			'setting' => $setting,
+			'code'    => $code,
+			'message' => $message,
+			'type'    => $type,
+		);
 	}
 }
 

tests/unit/DomainValidationTest.php

@@ -18,8 +18,27 @@ final class DomainValidationTest extends TestCase {
 	protected function setUp(): void {
 		parent::setUp();
 
+		$this->resetTestState();
+	}
+
+	/**
+	 * Reset options after tests.
+	 */
+	protected function tearDown(): void {
+		$this->resetTestState();
+
+		parent::tearDown();
+	}
+
+	/**
+	 * Reset mutable WordPress test state used by these tests.
+	 */
+	private function resetTestState(): void {
+		global $wp_settings_errors;
+
 		delete_option( 'es_optimizer_options' );
 		es_optimizer_clear_options_cache();
+		$wp_settings_errors = array();
 	}
 
 	/**
@@ -74,9 +93,20 @@ public static function rejectedDomainProvider(): array {
 	public function test_domain_list_keeps_unique_clean_https_domains(): void {
 		$input = "https://fonts.googleapis.com\nhttps://example.com/path\nhttps://fonts.googleapis.com\nhttps://cdn.example.com";
 
+		$result = es_optimizer_validate_domain_list( $input, 'preconnect' );
+
 		$this->assertSame(
 			"https://fonts.googleapis.com\nhttps://cdn.example.com",
-			es_optimizer_validate_domain_list( $input, 'preconnect' )
+			$result
+		);
+		$this->assertContains(
+			array(
+				'setting' => 'es_optimizer_options',
+				'code'    => 'preconnect_security',
+				'message' => 'Some preconnect domains were rejected for security reasons: https://example.com/path (file paths are not allowed; use domains only)',
+				'type'    => 'warning',
+			),
+			$GLOBALS['wp_settings_errors']
 		);
 	}