Fix decode_range() slow path leaking invalid UTF-8 bytes

[Copilot]

In decode_range(), the slow path (triggered by \, \r, \f, or \x00) skipped wp_scrub_utf8() on normal text segments and on decode_escape_at() output — inconsistent with the fast path. This means invalid UTF-8 bytes adjacent to backslash escapes would pass through unscrubb ed.

Fix

• Normal segments (slow path): wrap substr(...) with wp_scrub_utf8(), matching the fast path
• Escape output: wrap decode_escape_at() return value with wp_scrub_utf8() — its "anything else" path can return raw invalid bytes when the escaped character is itself an invalid byte sequence

Tests

Two regression tests added to CSSProcessorTest:

// Invalid byte in normal segment before a hex escape — slow path triggered by
// the backslash, but 0xF1 sits in the preceding segment that was not scrubbed.
$css = ".test\xF1\\41name";
// Expected ident value: "test\u{FFFD}Aname"

// Invalid byte as the escaped character itself — decode_escape_at() returns
// the raw byte, which must be scrubbed at the call site.
$css = ".a\\\xF1b";
// Expected ident value: "a\u{FFFD}b"

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/8da41e9a9fe4cc14d23cf7fcef3b80476f54e511
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/PHPCSStandards/composer-installer/zipball/e9cf5e4bbf7eeaf9ef5db34938942602838fc2b1
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/PHPCompatibility/PHPCompatibility/zipball/9fb324479acf6f39452e0655d2429cc0d3914243
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/doctrine/instantiator/zipball/0daa7cfba7b009aa3c95ae585322fb596a4ca2ae
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/phar-io/manifest/zipball/65f90285728eae4eae313b8b6ba11b2f5436038e
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/phpstan/phpstan/zipball/fcf8b71aeab4e1a1131d1783cef97b23a51b87a9
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/oLikmP /usr/bin/composer install (http block)
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ENGYkI /usr/bin/composer install --no-interaction r.git com-PHPCSStandargit (http block)
• https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/ac91f01ccec49fb77bdc6fd1e548bc70f7faa3e5
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
• https://api.github.com/repos/sebastianbergmann/complexity/zipball/25f207c40d62b8b7aa32f5ab026c53561964053a
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
• https://api.github.com/repos/sebastianbergmann/environment/zipball/830c43a844f1f8d5b7a1f6d6076b784454d8b7ed
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
• https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/0448d60087a382392a1b2a1abe434466e03dcc87
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
• https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/38b24367e1b340aa78b96d7cab042942d917bb84
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)
• https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/5da5f67fc95621df9ff4c4e5a84d6a8a2acf7c28
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/lhouf9 /usr/bin/composer install --quiet (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[sirreal]

Superseded by #229.