From 10297f0ed7aa13765f50d5025f1589bc931c6beb Mon Sep 17 00:00:00 2001 From: Al-Amin Firdows Date: Sat, 27 Jun 2026 11:23:02 +0600 Subject: [PATCH 1/2] Trim whitespace from --exclude entries after comma split Both core and plugin verify-checksums used explode(',', $exclude) without trimming, causing entries like ' b' in 'a, b' to silently not match. Wrap with array_map('trim', ...) so 'a, b' and 'a,b' behave identically. --- src/Checksum_Core_Command.php | 2 +- src/Checksum_Plugin_Command.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Checksum_Core_Command.php b/src/Checksum_Core_Command.php index 8bca3518..5a956327 100644 --- a/src/Checksum_Core_Command.php +++ b/src/Checksum_Core_Command.php @@ -126,7 +126,7 @@ public function __invoke( $args, $assoc_args ) { if ( ! empty( $assoc_args['exclude'] ) ) { $exclude = Utils\get_flag_value( $assoc_args, 'exclude', '' ); - $this->exclude_files = explode( ',', $exclude ); + $this->exclude_files = array_map( 'trim', explode( ',', $exclude ) ); } if ( empty( $wp_version ) ) { diff --git a/src/Checksum_Plugin_Command.php b/src/Checksum_Plugin_Command.php index cf3f38f2..048be108 100644 --- a/src/Checksum_Plugin_Command.php +++ b/src/Checksum_Plugin_Command.php @@ -103,7 +103,7 @@ public function __invoke( $args, $assoc_args ) { WP_CLI::error( 'You need to specify either one or more plugin slugs to check or use the --all flag to check all plugins.' ); } - $exclude_list = explode( ',', $exclude ); + $exclude_list = array_map( 'trim', explode( ',', $exclude ) ); $skips = 0; From 7fc25ab887622e7e57d683c8c2e695f4fcc819f8 Mon Sep 17 00:00:00 2001 From: Al-Amin Firdows Date: Sat, 27 Jun 2026 11:23:06 +0600 Subject: [PATCH 2/2] Add tests for --exclude whitespace trimming behavior Covers the case where users pass comma-separated values with surrounding spaces (e.g. 'a, b') which should behave identically to 'a,b'. --- features/checksum-core.feature | 16 ++++++++++++++++ features/checksum-plugin.feature | 19 +++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/features/checksum-core.feature b/features/checksum-core.feature index 665d98cf..ce194846 100644 --- a/features/checksum-core.feature +++ b/features/checksum-core.feature @@ -312,3 +312,19 @@ Feature: Validate checksums for WordPress install Success: WordPress installation verifies against checksums. """ And the return code should be 0 + + Scenario: Verify core checksums with excluded files containing whitespace around comma separators + Given a WP install + And "WordPress" replaced with "PressWord" in the readme.html file + And a wp-includes/some-filename.php file: + """ + sample content of some file + """ + + When I try `wp core verify-checksums --exclude='readme.html, wp-includes/some-filename.php'` + Then STDERR should be empty + And STDOUT should be: + """ + Success: WordPress installation verifies against checksums. + """ + And the return code should be 0 diff --git a/features/checksum-plugin.feature b/features/checksum-plugin.feature index 98920c6f..7b1dba6f 100644 --- a/features/checksum-plugin.feature +++ b/features/checksum-plugin.feature @@ -153,6 +153,25 @@ Feature: Validate checksums for WordPress plugins When I try `wp plugin verify-checksums --all --exclude=akismet` Then STDOUT should match /^Success: Verified \d of \d plugins \(\d skipped\)\./ + Scenario: Plugin verification is skipped when --exclude entries have surrounding whitespace + Given a WP install + + When I run `wp plugin delete --all` + Then STDOUT should contain: + """ + Success: + """ + + # Ignore plugin's version requirements because we don't actually activate it. + When I run `wp plugin install akismet --ignore-requirements` + Then STDOUT should contain: + """ + Success: + """ + + When I try `wp plugin verify-checksums --all --exclude=' akismet'` + Then STDOUT should match /^Success: Verified \d of \d plugins \(\d skipped\)\./ + Scenario: Plugin is verified when the --exclude argument isn't included Given a WP install