MOONy

✎ EDIT FILE

EDITING: StylesheetFetcher.php

<?php
/**
 * Fetches the *contents* of linked stylesheets so fonts hidden inside theme /
 * plugin / CDN CSS can be detected — the capability plain output-buffer
 * scanners miss.
 *
 * @package EasyFonts
 */

namespace EasyFonts\Detect;

use EasyFonts\Fonts\Downloader;

defined( 'ABSPATH' ) || exit;

/**
 * Resolves stylesheet URLs to CSS contents (disk for local, HTTP for external).
 */
class StylesheetFetcher {

/**
	 * Already-processed URLs this request (avoids duplicate work).
	 *
	 * @var array<string,bool>
	 */
	private array $seen = array();

/**
	 * Read a same-origin stylesheet from disk.
	 *
	 * @param string $url Absolute or root-relative URL.
	 * @return string|null
	 */
	public function read_local( string $url ): ?string {
		$url = $this->normalize( $url );

if ( isset( $this->seen[ $url ] ) ) {
			return null;
		}

$this->seen[ $url ] = true;

$path = $this->url_to_path( $url );

if ( null === $path || ! is_file( $path ) ) {
			return null;
		}

$css = @file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions

return false === $css ? null : $css;
	}

/**
	 * Fetch an external stylesheet over HTTP (once).
	 *
	 * @param string     $url        URL.
	 * @param Downloader $downloader Downloader.
	 * @return string|null
	 */
	public function read_external( string $url, Downloader $downloader ): ?string {
		$url = $this->normalize( $url );

if ( isset( $this->seen[ $url ] ) ) {
			return null;
		}

$this->seen[ $url ] = true;

return $downloader->fetch_css( $url );
	}

/**
	 * Is this URL same-origin?
	 *
	 * @param string $url URL.
	 * @return bool
	 */
	public function is_local( string $url ): bool {
		$url  = $this->normalize( $url );
		$home = home_url();

return str_starts_with( $url, $home ) || str_starts_with( $url, '/' );
	}

/**
	 * Should we skip this stylesheet entirely (core, our own cache, etc.)?
	 *
	 * @param string $url URL.
	 * @return bool
	 */
	public function is_skippable( string $url ): bool {
		foreach ( array( 'wp-includes', '/easyfonts/', 'fonts.googleapis.com', 'fonts.bunny.net' ) as $needle ) {
			if ( false !== strpos( $url, $needle ) ) {
				return true;
			}
		}

return false;
	}

/**
	 * Map a same-origin URL to a filesystem path.
	 *
	 * @param string $url URL.
	 * @return string|null
	 */
	private function url_to_path( string $url ): ?string {
		$url = strtok( $url, '?' ); // Drop query (dynamic CSS handled elsewhere).

// LFI guard. A linked stylesheet is always a real .css file with no
		// path-traversal. Reject anything else BEFORE it can touch the disk, so
		// a crafted href like "/wp-config.php" or "/a/../../../etc/passwd" can
		// never be read. Decode first so percent-encoded "%2e%2e" is caught too.
		$path = (string) wp_parse_url( $url, PHP_URL_PATH );

if ( false !== strpos( rawurldecode( (string) $url ), '..' ) ) {
			return null;
		}

if ( ! preg_match( '/\.css$/i', $path ) ) {
			return null;
		}

$content_url = content_url();

if ( str_starts_with( $url, $content_url ) ) {
			return str_replace( $content_url, WP_CONTENT_DIR, $url );
		}

$home = home_url();

if ( str_starts_with( $url, $home ) ) {
			return str_replace( $home, untrailingslashit( ABSPATH ), $url );
		}

if ( str_starts_with( $url, '/' ) ) {
			return untrailingslashit( ABSPATH ) . $url;
		}

return null;
	}

/**
	 * Normalize protocol-relative / root-relative URLs to absolute.
	 *
	 * @param string $url URL.
	 * @return string
	 */
	private function normalize( string $url ): string {
		$url = html_entity_decode( $url, ENT_QUOTES, 'UTF-8' );

if ( str_starts_with( $url, '//' ) ) {
			return ( is_ssl() ? 'https:' : 'http:' ) . $url;
		}

if ( str_starts_with( $url, '/' ) ) {
			return home_url( $url );
		}

return $url;
	}
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 Consolidator.php	PHP	47.8 KB	2026-06-10 13:15	EDIT
📄 Pipeline.php	PHP	1.6 KB	2026-06-10 13:15	EDIT
📄 Providers.php	PHP	4.9 KB	2026-06-10 13:15	EDIT
📄 StylesheetFetcher.php	PHP	3.7 KB	2026-06-10 13:15	EDIT