Address feedback on port 443 support, add source:cloud by andrewshell · Pull Request #13 · rsscloud/rsscloud-wp-plugin

andrewshell · 2026-08-07T14:22:54Z

Follow-ups to the port 443 work in 0.5.1. Two commits walk back parts of it in response to feedback; a third restores https support in the place it actually belongs.

1. Revert the `<cloud>` element to port-80 / http-post (`7a6be2a`)

a541e55 made the <cloud> element advertise port='443' / protocol='https-post' for https sites. That breaks FeedLand, the largest rssCloud consumer.

Reverts only the cloud element output to the original logic: explicit home port if present, otherwise 80, with protocol='http-post'. Subscriber-side 443 handling is untouched.

2. Remove the `http_allowed_safe_ports` whitelist (`e10ebad`)

d05bd40 added a filter whitelisting the subscriber's port so wp_safe_remote_*() could reach non-standard ports. As raised in review, this won't work on WordPress.com — outbound requests are restricted by firewall rules independent of WordPress's own URL validation — so it adds complexity without reliably delivering the capability.

Gives up: subscribers on non-standard ports. Ports 80 and 443 are unaffected, both being in WordPress's default allowed ports.

Keeps: the wp_safe_remote_*() calls introduced alongside the whitelist — a separate improvement bundled into the same commit. send-post-notifications.php is now byte-identical to its pre-d05bd40 state, while notification-request.php ends up safer than before the 443 series.

3. Add `source:cloud` (`856be0c`)

With <cloud> pinned to port 80 / http-post, it can no longer advertise https. source:cloud carries the full notification URL as element content, so newer readers get the site's real scheme. Emitting both gives the widest reader support:

<cloud domain='secure.example.com' port='80' path='/?rsscloud=notify' registerProcedure='' protocol='http-post' />
<source:cloud xmlns:source='https://source.scripting.com/'>https://secure.example.com/?rsscloud=notify</source:cloud>

On declaring the namespace inline rather than via rss2_ns — this is deliberate, and worth a look since it's the unconventional choice:

The feed-rss2.php template concatenates rss2_ns callbacks with no separator. Any other plugin emitting xmlns:source on the <rss> tag would produce a duplicate attribute, which is a well-formedness error under XML 1.0 even with identical values — the feed stops parsing entirely. team51-markdown-rss does exactly this, unguarded, for its source:markdown element.

Inline declaration also guards the quieter failure. Namespace declarations are scoped, so a plugin binding source to a different URI on <rss> would make source:cloud resolve to the wrong namespace — newer readers skip it, with no error and no visibly broken feed. Per Namespaces in XML 1.0 §6.1, the inner declaration shadows the outer one for this element. test_feed_with_source_cloud_is_well_formed_xml asserts this against a deliberately hostile <rss> tag.

4. Bump minimum WordPress version to 3.6 (`7c7b27d`)

Plugin check fails against the declared minimum of 2.8 — wp_unslash() and wp_safe_remote_post() both need 3.6.0. Neither is new on this branch; the check surfaces here because d05bd40 and friends landed on main without a PR, so it never ran on them. One-line metadata correction, happy to split it out if you'd rather.

Testing

63 tests, 110 assertions — all passing. Five new tests cover source:cloud: presence, inline namespace declaration, the https URL, escaping, and XML well-formedness under a conflicting <rss> binding.

🤖 Generated with Claude Code

Commit a541e55 made the RSS <cloud> element advertise port='443' for https sites, which breaks FeedLand (the largest rssCloud consumer). Revert only the cloud element output to the original logic: explicit home port if present, otherwise 80, with protocol='http-post'. The notification-request 443->https subscriber logic and the non-standard port whitelist are intentionally kept. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The whitelist added in d05bd40 let wp_safe_remote_*() reach subscribers on non-standard ports. It won't achieve that on WordPress.com, where outbound requests are restricted by firewall rules independent of WordPress's own URL validation, so it adds complexity without reliably delivering the capability. Remove the filter from both the notification request and post notification paths, along with the tests and changelog entry documenting it. Subscribers on non-standard ports are no longer supported; ports 80 and 443 continue to work, as both are in WordPress's default allowed ports. The wp_safe_remote_*() calls introduced alongside the whitelist are kept, so that SSRF protection survives independently of the port workaround. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-08-07T14:23:08Z

Warning

Review limit reached

@andrewshell, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 34 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d008fe2-16ea-4473-92c5-9fc9553b8fa5

📥 Commits

Reviewing files that changed from the base of the PR and between e10ebad and ea940c2.

📒 Files selected for processing (3)

rsscloud/readme.txt
rsscloud/rsscloud.php
tests/test-rsscloud.php

📝 Walkthrough

Walkthrough

Changes

Notification port handling

Layer / File(s)	Summary
RSS Cloud feed port default `rsscloud/rsscloud.php`, `tests/test-rsscloud.php`	Missing feed ports now default to `80`. The HTTPS-specific `443` default test is removed.
Notification safe-port filtering `rsscloud/notification-request.php`, `rsscloud/send-post-notifications.php`, `tests/test-send-post-notifications.php`, `rsscloud/readme.txt`	Notification requests no longer modify WordPress’s `http_allowed_safe_ports` filter. Related non-standard-port test coverage and changelog text are removed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a rabbit with ports in a row,
Eighty is the default to show.
Safe-port filters now rest,
Old port tests leave the nest.
HTTPS notes remain in flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the main changes: port 443 support and the RSS Cloud source update.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch address-port-443-feedback

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-07T14:24:36Z

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

Plugin check fails against the declared minimum of 2.8: wp_unslash() and wp_safe_remote_post() both require WordPress 3.6.0. Neither is new here, so this corrects metadata that has been wrong since those calls were introduced. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The cloud element is pinned to port 80 / http-post so FeedLand and other older readers keep working, which leaves it unable to advertise an https endpoint. source:cloud carries the full notification URL as element content, so newer readers get the site's real scheme. Emitting both gives the widest reader support. The namespace is declared on the element itself rather than through the rss2_ns action. Doing it the conventional way collides with any other plugin that binds the source prefix on the rss tag: the WordPress template concatenates rss2_ns callbacks with no separator, so two plugins emitting xmlns:source produce a duplicate attribute and the feed stops parsing. team51-markdown-rss does exactly this, unguarded, for its source:markdown element. Declaring inline also guards against the quieter failure. Namespace declarations are scoped, so a plugin binding the source prefix to a different uri on the rss tag would otherwise make source:cloud resolve to the wrong namespace, and newer readers would skip it with no error and no broken feed. The inner declaration shadows the outer one for this element, which the tests assert against a hostile rss tag. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Raising the minimum to 3.6 in the previous commit made plugin check newly flag these calls: wp_strip_all_tags() arrived in WordPress 2.9.0, so while the declared minimum was 2.8 the check could not recommend it. wp_strip_all_tags() is a safe swap here. It strips script and style content rather than just the tags, and trims the result; both values are short strings that then pass through ent2ncr() and esc_html() before being emitted as XML attributes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

andrewshell and others added 2 commits May 15, 2026 08:23

andrewshell and others added 2 commits August 7, 2026 09:42

andrewshell changed the title ~~Address feedback on port 443 support~~ Address feedback on port 443 support, add source:cloud Aug 7, 2026

andrewshell merged commit f3533ea into main Aug 7, 2026
5 checks passed

andrewshell deleted the address-port-443-feedback branch August 7, 2026 15:17

Navigation Menu

Uh oh!

Address feedback on port 443 support, add source:cloud - #13

Address feedback on port 443 support, add source:cloud#13
andrewshell merged 5 commits into
mainfrom
address-port-443-feedback

andrewshell commented Aug 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

andrewshell commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1. Revert the <cloud> element to port-80 / http-post (7a6be2a)

2. Remove the http_allowed_safe_ports whitelist (e10ebad)

3. Add source:cloud (856be0c)

4. Bump minimum WordPress version to 3.6 (7c7b27d)

Testing

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ WordPress Plugin Check Report

📊 Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

andrewshell commented Aug 7, 2026 •

edited

Loading

1. Revert the `<cloud>` element to port-80 / http-post (`7a6be2a`)

2. Remove the `http_allowed_safe_ports` whitelist (`e10ebad`)

3. Add `source:cloud` (`856be0c`)

4. Bump minimum WordPress version to 3.6 (`7c7b27d`)

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

github-actions Bot commented Aug 7, 2026 •

edited

Loading