From 348fe09ccfe41bea9774db0372dda104b63797a8 Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Tue, 20 May 2025 11:13:19 +0200
Subject: [PATCH 1/4] PHPStan level 9

---
 composer.json            |  7 +++--
 features/fetch.feature   | 55 -----------------------------------
 phpstan.neon.dist        | 20 +++++++++++++
 src/Cache_Command.php    |  6 +---
 src/Fetch_Command.php    | 63 +++++++++++++++++-----------------------
 src/Provider_Command.php | 10 ++-----
 src/oEmbed.php           | 59 -------------------------------------
 7 files changed, 55 insertions(+), 165 deletions(-)
 create mode 100644 phpstan.neon.dist
 delete mode 100644 src/oEmbed.php

diff --git a/composer.json b/composer.json
index 1f8f7b6..66ebb0b 100644
--- a/composer.json
+++ b/composer.json
@@ -15,14 +15,15 @@
     },
     "require-dev": {
         "wp-cli/entity-command": "^1.3 || ^2",
-        "wp-cli/wp-cli-tests": "^4"
+        "wp-cli/wp-cli-tests": "dev-main"
     },
     "config": {
         "process-timeout": 7200,
         "sort-packages": true,
         "allow-plugins": {
             "dealerdirect/phpcodesniffer-composer-installer": true,
-            "johnpbloch/wordpress-core-installer": true
+            "johnpbloch/wordpress-core-installer": true,
+            "phpstan/extension-installer": true
         },
         "lock": false
     },
@@ -60,12 +61,14 @@
         "behat-rerun": "rerun-behat-tests",
         "lint": "run-linter-tests",
         "phpcs": "run-phpcs-tests",
+        "phpstan": "run-phpstan-tests",
         "phpcbf": "run-phpcbf-cleanup",
         "phpunit": "run-php-unit-tests",
         "prepare-tests": "install-package-tests",
         "test": [
             "@lint",
             "@phpcs",
+            "@phpstan",
             "@phpunit",
             "@behat"
         ]
diff --git a/features/fetch.feature b/features/fetch.feature
index d3ac3ea..68ef353 100644
--- a/features/fetch.feature
+++ b/features/fetch.feature
@@ -90,32 +90,6 @@ Feature: Manage oEmbed fetch.
       <a
       """
 
-  # `wp_filter_oembed_result` filter introduced WP 4.4 which sanitizes oEmbed responses that don't include an iframe.
-  @less-than-wp-4.9 @require-wp-4.4
-  Scenario: Get HTML embed code for a given URL that requires discovery and is sanitized
-    When I try `wp embed fetch https://view.ceros.com/ceros/new-experience-3/p/1`
-    Then the return code should be 1
-    And STDERR should be:
-      """
-      Error: There was an error fetching the oEmbed data.
-      """
-    And STDOUT should be empty
-
-  # No sanitization prior to WP 4.4.
-  @less-than-wp-4.4 @require-wp-4.0
-  Scenario: Get HTML embed code for a given URL that requires discovery and is sanitized
-    # Old versions of WP_oEmbed can trigger PHP "Only variables should be passed by reference" notices on discover so use "try" to cater for these.
-    When I try `wp embed fetch https://view.ceros.com/ceros/new-experience-3/p/1`
-    Then the return code should be 0
-    And STDERR should not contain:
-      """
-      Error:
-      """
-    And STDOUT should contain:
-      """
-      ceros.com/
-      """
-
   @require-wp-4.0
   Scenario: Get raw oEmbed data for a given URL
     When I run `wp embed fetch https://www.youtube.com/watch?v=dQw4w9WgXcQ --raw`
@@ -192,18 +166,6 @@ Feature: Manage oEmbed fetch.
       <a href="https://foo.example.com">https://foo.example.com</a>
       """
 
-  # WP prior to 4.9 does not return clickable link.
-  @less-than-wp-4.9 @require-wp-4.0
-  Scenario: Doesn't make unknown URLs clickable
-    When I try `wp embed fetch https://foo.example.com`
-    Then the return code should be 1
-    # Old versions of WP_oEmbed can trigger PHP "Only variables should be passed by reference" notices on discover so use "contain" to cater for these.
-    And STDERR should contain:
-      """
-      Error: There was an error fetching the oEmbed data.
-      """
-    And STDOUT should be empty
-
   @require-wp-4.0
   Scenario: Caches oEmbed response data for a given post
     # Note need post author for 'unfiltered_html' check to work for WP < 4.4.
@@ -410,23 +372,6 @@ Feature: Manage oEmbed fetch.
       <video
       """
 
-  # `wp_embed_handler_googlevideo` handler deprecated WP 4.6.
-  @less-than-wp-4.6 @require-wp-4.0
-  Scenario: Invoke built-in Google Video handler
-    When I run `wp post create --post_title="Foo Bar" --porcelain`
-    Then STDOUT should be a number
-    And save STDOUT as {POST_ID}
-
-    When I run `wp embed fetch http://video.google.com/videoplay?docid=123456789 --post-id={POST_ID}`
-    Then STDOUT should contain:
-      """
-      video.google.com
-      """
-    And STDOUT should contain:
-      """
-      <embed
-      """
-
   @require-wp-4.0
   Scenario: Incompatible options
     When I try `wp embed fetch https://www.example.com/watch?v=dQw4w9WgXcQ --no-discover --limit-response-size=50000`
diff --git a/phpstan.neon.dist b/phpstan.neon.dist
new file mode 100644
index 0000000..d939c98
--- /dev/null
+++ b/phpstan.neon.dist
@@ -0,0 +1,20 @@
+parameters:
+  level: 9
+  paths:
+    - src
+    - embed-command.php
+  scanDirectories:
+    - vendor/wp-cli/wp-cli/php
+    - vendor/wp-cli/wp-cli-tests
+  scanFiles:
+    - vendor/php-stubs/wordpress-stubs/wordpress-stubs.php
+  treatPhpDocTypesAsCertain: false
+  dynamicConstantNames:
+  	- WP_DEBUG
+  	- WP_DEBUG_LOG
+  	- WP_DEBUG_DISPLAY
+  ignoreErrors:
+    - identifier: missingType.iterableValue
+    - identifier: missingType.property
+    - identifier: missingType.parameter
+    - identifier: missingType.return
diff --git a/src/Cache_Command.php b/src/Cache_Command.php
index da067a7..f1a3ad7 100644
--- a/src/Cache_Command.php
+++ b/src/Cache_Command.php
@@ -100,10 +100,6 @@ function ( $v ) {
 	 *     123
 	 */
 	public function find( $args, $assoc_args ) {
-		if ( Utils\wp_version_compare( '4.9', '<' ) ) {
-			WP_CLI::error( 'Requires WordPress 4.9 or greater.' );
-		}
-
 		/** @var \WP_Embed $wp_embed */
 		global $wp_embed;
 
@@ -139,7 +135,7 @@ public function find( $args, $assoc_args ) {
 			$cached_post_id = $wp_embed->find_oembed_post_id( $key_suffix );
 
 			if ( $cached_post_id ) {
-				WP_CLI::line( $cached_post_id );
+				WP_CLI::line( (string) $cached_post_id );
 
 				return;
 			}
diff --git a/src/Fetch_Command.php b/src/Fetch_Command.php
index 778643e..ab3b715 100644
--- a/src/Fetch_Command.php
+++ b/src/Fetch_Command.php
@@ -69,23 +69,35 @@ public function __invoke( $args, $assoc_args ) {
 		/** @var \WP_Embed $wp_embed */
 		global $wp_embed;
 
-		$url                 = $args[0];
-		$raw                 = Utils\get_flag_value( $assoc_args, 'raw' );
-		$raw_format          = Utils\get_flag_value( $assoc_args, 'raw-format' );
+		$url        = $args[0];
+		$raw        = (bool) Utils\get_flag_value( $assoc_args, 'raw' );
+		$raw_format = Utils\get_flag_value( $assoc_args, 'raw-format' );
+
+		/**
+		 * @var string|null $post_id
+		 */
 		$post_id             = Utils\get_flag_value( $assoc_args, 'post-id' );
 		$discover            = Utils\get_flag_value( $assoc_args, 'discover' );
 		$response_size_limit = Utils\get_flag_value( $assoc_args, 'limit-response-size' );
-		$width               = Utils\get_flag_value( $assoc_args, 'width' );
-		$height              = Utils\get_flag_value( $assoc_args, 'height' );
+
+		/**
+		 * @var string $width
+		 */
+		$width = Utils\get_flag_value( $assoc_args, 'width' );
+
+		/**
+		 * @var string $height
+		 */
+		$height = Utils\get_flag_value( $assoc_args, 'height' );
 
 		// The `$key_suffix` used for caching is part based on serializing the attributes array without normalizing it first so need to try to replicate that.
 		$oembed_args = array();
 
 		if ( null !== $width ) {
-			$oembed_args['width'] = $width; // Keep as string as if from a shortcode attribute.
+			$oembed_args['width'] = (int) $width;
 		}
 		if ( null !== $height ) {
-			$oembed_args['height'] = $height; // Keep as string as if from a shortcode attribute.
+			$oembed_args['height'] = (int) $height;
 		}
 		if ( null !== $discover ) {
 			$oembed_args['discover'] = $discover ? '1' : '0'; // Make it a string as if from a shortcode attribute.
@@ -102,10 +114,6 @@ public function __invoke( $args, $assoc_args ) {
 		}
 
 		if ( $response_size_limit ) {
-			if ( Utils\wp_version_compare( '4.0', '<' ) ) {
-				WP_CLI::warning( "The 'limit-response-size' option only works for WordPress 4.0 onwards." );
-				// Fall through anyway...
-			}
 			add_filter(
 				'oembed_remote_get_args',
 				function ( $args ) use ( $response_size_limit ) {
@@ -119,7 +127,7 @@ function ( $args ) use ( $response_size_limit ) {
 
 		// If raw, query providers directly, by-passing cache.
 		if ( $raw ) {
-			$oembed = new oEmbed(); // Needs to be here to make sure `_wp_oembed_get_object()` defined (in "wp-includes/class-oembed.php" for WP < 4.7).
+			$oembed = new \WP_oEmbed();
 
 			$oembed_args['discover'] = $discover;
 
@@ -160,9 +168,9 @@ function ( $ret, $data, $url ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunc
 				if ( ! class_exists( 'SimpleXMLElement' ) ) {
 					WP_CLI::error( "The PHP extension 'SimpleXMLElement' is not available but is required for XML-formatted output." );
 				}
-				WP_CLI::log( $this->oembed_create_xml( (array) $data ) );
+				WP_CLI::log( (string) $this->oembed_create_xml( (array) $data ) );
 			} else {
-				WP_CLI::log( json_encode( $data ) );
+				WP_CLI::log( (string) json_encode( $data ) );
 			}
 
 			return;
@@ -170,17 +178,17 @@ function ( $ret, $data, $url ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunc
 
 		if ( $post_id ) {
 			// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- the request is asking for a post id directly so need to override the global.
-			$GLOBALS['post'] = get_post( $post_id );
+			$GLOBALS['post'] = get_post( (int) $post_id );
 			if ( null === $GLOBALS['post'] ) {
 				WP_CLI::warning( sprintf( "Post id '%s' not found.", $post_id ) );
 			}
 		}
 
-		if ( Utils\get_flag_value( $assoc_args, 'skip-sanitization' ) ) {
-			remove_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10, 3 );
+		if ( (bool) Utils\get_flag_value( $assoc_args, 'skip-sanitization' ) ) {
+			remove_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10 );
 		}
 
-		if ( Utils\get_flag_value( $assoc_args, 'skip-cache' ) ) {
+		if ( (bool) Utils\get_flag_value( $assoc_args, 'skip-cache' ) ) {
 			$wp_embed->usecache = false;
 			// In order to skip caching, also need `$cached_recently` to be false in `WP_Embed::shortcode()`, so set TTL to zero.
 			add_filter( 'oembed_ttl', '__return_zero', PHP_INT_MAX );
@@ -191,27 +199,8 @@ function ( $ret, $data, $url ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunc
 		// `WP_Embed::shortcode()` sets the 'discover' attribute based on 'embed_oembed_discover' filter, no matter what's passed to it.
 		add_filter( 'embed_oembed_discover', $discover ? '__return_true' : '__return_false', PHP_INT_MAX );
 
-		// For WP < 4.9, `WP_Embed::shortcode()` won't check providers if no post_id supplied, so set `maybe_make_link()` to return false so can check and do it ourselves.
-		// Also set if WP < 4.4 and don't have 'unfiltered_html' privileges on post.
-		$check_providers = Utils\wp_version_compare( '4.9', '<' ) && ( ! $post_id || ( Utils\wp_version_compare( '4.4', '<' ) && ! author_can( $post_id, 'unfiltered_html' ) ) );
-		if ( $check_providers ) {
-			add_filter( 'embed_maybe_make_link', '__return_false', PHP_INT_MAX );
-		}
-
 		$html = $wp_embed->shortcode( $oembed_args, $url );
 
-		if ( false === $html && $check_providers ) {
-
-			// Check providers.
-			$oembed_args['discover'] = $discover;
-			$html                    = wp_oembed_get( $url, $oembed_args );
-
-			// `wp_oembed_get()` returns zero-length string instead of false on failure due to `_strip_newlines()` 'oembed_dataparse' filter so make sure false.
-			if ( '' === $html ) {
-				$html = false;
-			}
-		}
-
 		if ( false !== $html && '[' === substr( $html, 0, 1 ) && Utils\get_flag_value( $assoc_args, 'do-shortcode' ) ) {
 			$html = do_shortcode( $html, true );
 		}
diff --git a/src/Provider_Command.php b/src/Provider_Command.php
index 295f990..feea15a 100644
--- a/src/Provider_Command.php
+++ b/src/Provider_Command.php
@@ -83,7 +83,7 @@ class Provider_Command extends WP_CLI_Command {
 	 */
 	public function list_providers( $args, $assoc_args ) {
 
-		$oembed = new oEmbed();
+		$oembed = new \WP_oEmbed();
 
 		$force_regex = Utils\get_flag_value( $assoc_args, 'force-regex' );
 
@@ -140,10 +140,10 @@ public function list_providers( $args, $assoc_args ) {
 	 * @subcommand match
 	 */
 	public function match_provider( $args, $assoc_args ) {
-		$oembed = new oEmbed();
+		$oembed = new \WP_oEmbed();
 
 		$url                 = $args[0];
-		$discover            = \WP_CLI\Utils\get_flag_value( $assoc_args, 'discover', true );
+		$discover            = (bool) \WP_CLI\Utils\get_flag_value( $assoc_args, 'discover', true );
 		$response_size_limit = \WP_CLI\Utils\get_flag_value( $assoc_args, 'limit-response-size' );
 		$link_type           = \WP_CLI\Utils\get_flag_value( $assoc_args, 'link-type' );
 
@@ -159,10 +159,6 @@ public function match_provider( $args, $assoc_args ) {
 		}
 
 		if ( $response_size_limit ) {
-			if ( Utils\wp_version_compare( '4.0', '<' ) ) {
-				WP_CLI::warning( "The 'limit-response-size' option only works for WordPress 4.0 onwards." );
-				// Fall through anyway...
-			}
 			add_filter(
 				'oembed_remote_get_args',
 				function ( $args ) use ( $response_size_limit ) {
diff --git a/src/oEmbed.php b/src/oEmbed.php
deleted file mode 100644
index ad9831f..0000000
--- a/src/oEmbed.php
+++ /dev/null
@@ -1,59 +0,0 @@
-<?php
-
-namespace WP_CLI\Embeds;
-
-if ( ! class_exists( '\WP_oEmbed' ) ) {
-	require_once ABSPATH . WPINC . '/class-oembed.php';
-}
-
-/**
- * Polyfill for older WP versions.
- */
-class oEmbed extends \WP_oEmbed {
-
-	/**
-	 * Takes a URL and returns the corresponding oEmbed provider's URL, if there is one.
-	 *
-	 * @since 4.0.0
-	 *
-	 * @see WP_oEmbed::discover()
-	 *
-	 * @param string        $url  The URL to the content.
-	 * @param string|array  $args Optional provider arguments.
-	 * @return false|string False on failure, otherwise the oEmbed provider URL.
-	 */
-	public function get_provider( $url, $args = '' ) {
-		if ( method_exists( 'WP_oEmbed', 'get_provider' ) ) {
-			return parent::get_provider( $url, $args );
-		}
-
-		$args = wp_parse_args( $args );
-
-		$provider = false;
-
-		if ( ! isset( $args['discover'] ) ) {
-			$args['discover'] = true;
-		}
-
-		foreach ( $this->providers as $matchmask => $data ) {
-			list( $providerurl, $regex ) = $data;
-
-			// Turn the asterisk-type provider URLs into regex
-			if ( ! $regex ) {
-				$matchmask = '#' . str_replace( '___wildcard___', '(.+)', preg_quote( str_replace( '*', '___wildcard___', $matchmask ), '#' ) ) . '#i';
-				$matchmask = preg_replace( '|^#http\\\://|', '#https?\://', $matchmask );
-			}
-
-			if ( preg_match( $matchmask, $url ) ) {
-				$provider = str_replace( '{format}', 'json', $providerurl ); // JSON is easier to deal with than XML
-				break;
-			}
-		}
-
-		if ( ! $provider && $args['discover'] ) {
-			$provider = $this->discover( $url );
-		}
-
-		return $provider;
-	}
-}

From 14b3c458fa69fe1a936cb73d18c63b301b5f56b7 Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Thu, 12 Jun 2025 10:51:49 +0200
Subject: [PATCH 2/4] small cleanup

---
 composer.json            |  2 +-
 phpstan.neon.dist        |  5 -----
 src/Provider_Command.php | 14 ++++++++++----
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/composer.json b/composer.json
index 66ebb0b..59db6ec 100644
--- a/composer.json
+++ b/composer.json
@@ -15,7 +15,7 @@
     },
     "require-dev": {
         "wp-cli/entity-command": "^1.3 || ^2",
-        "wp-cli/wp-cli-tests": "dev-main"
+        "wp-cli/wp-cli-tests": "dev-add/phpstan-enhancements"
     },
     "config": {
         "process-timeout": 7200,
diff --git a/phpstan.neon.dist b/phpstan.neon.dist
index d939c98..25c2e56 100644
--- a/phpstan.neon.dist
+++ b/phpstan.neon.dist
@@ -5,14 +5,9 @@ parameters:
     - embed-command.php
   scanDirectories:
     - vendor/wp-cli/wp-cli/php
-    - vendor/wp-cli/wp-cli-tests
   scanFiles:
     - vendor/php-stubs/wordpress-stubs/wordpress-stubs.php
   treatPhpDocTypesAsCertain: false
-  dynamicConstantNames:
-  	- WP_DEBUG
-  	- WP_DEBUG_LOG
-  	- WP_DEBUG_DISPLAY
   ignoreErrors:
     - identifier: missingType.iterableValue
     - identifier: missingType.property
diff --git a/src/Provider_Command.php b/src/Provider_Command.php
index feea15a..9cc8ff7 100644
--- a/src/Provider_Command.php
+++ b/src/Provider_Command.php
@@ -80,6 +80,9 @@ class Provider_Command extends WP_CLI_Command {
 	 *     | #https?://wordpress\.tv/.*#i | https://wordpress.tv/oembed/            |
 	 *
 	 * @subcommand list
+	 *
+	 * @param string[] $args Positional arguments. Unused.
+	 * @param array{field?: string, fields?: string, format: 'table'|'csv'|'json', 'force-regex'?: bool} $assoc_args Associative arguments.
 	 */
 	public function list_providers( $args, $assoc_args ) {
 
@@ -138,14 +141,17 @@ public function list_providers( $args, $assoc_args ) {
 	 *     https://www.youtube.com/oembed
 	 *
 	 * @subcommand match
+	 *
+	 * @param array{0: string} $args Positional arguments.
+	 * @param array{discover?: bool, 'limit-response-size'?: string, 'link-type'?: 'json'|'xml', } $assoc_args Associative arguments.
 	 */
 	public function match_provider( $args, $assoc_args ) {
 		$oembed = new \WP_oEmbed();
 
 		$url                 = $args[0];
-		$discover            = (bool) \WP_CLI\Utils\get_flag_value( $assoc_args, 'discover', true );
-		$response_size_limit = \WP_CLI\Utils\get_flag_value( $assoc_args, 'limit-response-size' );
-		$link_type           = \WP_CLI\Utils\get_flag_value( $assoc_args, 'link-type' );
+		$discover            = Utils\get_flag_value( $assoc_args, 'discover', true );
+		$response_size_limit = Utils\get_flag_value( $assoc_args, 'limit-response-size' );
+		$link_type           = Utils\get_flag_value( $assoc_args, 'link-type' );
 
 		if ( ! $discover && ( null !== $response_size_limit || null !== $link_type ) ) {
 			if ( null !== $response_size_limit && null !== $link_type ) {
@@ -162,7 +168,7 @@ public function match_provider( $args, $assoc_args ) {
 			add_filter(
 				'oembed_remote_get_args',
 				function ( $args ) use ( $response_size_limit ) {
-					$args['limit_response_size'] = $response_size_limit;
+					$args['limit_response_size'] = (int) $response_size_limit;
 					return $args;
 				}
 			);

From f5d710d9ed5d61548f83b8829175a2e3301d340d Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Thu, 12 Jun 2025 11:00:32 +0200
Subject: [PATCH 3/4] more cleanup

---
 src/Fetch_Command.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/Fetch_Command.php b/src/Fetch_Command.php
index ab3b715..6ada816 100644
--- a/src/Fetch_Command.php
+++ b/src/Fetch_Command.php
@@ -70,7 +70,7 @@ public function __invoke( $args, $assoc_args ) {
 		global $wp_embed;
 
 		$url        = $args[0];
-		$raw        = (bool) Utils\get_flag_value( $assoc_args, 'raw' );
+		$raw        = Utils\get_flag_value( $assoc_args, 'raw' );
 		$raw_format = Utils\get_flag_value( $assoc_args, 'raw-format' );
 
 		/**
@@ -184,11 +184,11 @@ function ( $ret, $data, $url ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunc
 			}
 		}
 
-		if ( (bool) Utils\get_flag_value( $assoc_args, 'skip-sanitization' ) ) {
+		if ( Utils\get_flag_value( $assoc_args, 'skip-sanitization', false ) ) {
 			remove_filter( 'oembed_dataparse', 'wp_filter_oembed_result', 10 );
 		}
 
-		if ( (bool) Utils\get_flag_value( $assoc_args, 'skip-cache' ) ) {
+		if ( Utils\get_flag_value( $assoc_args, 'skip-cache', false ) ) {
 			$wp_embed->usecache = false;
 			// In order to skip caching, also need `$cached_recently` to be false in `WP_Embed::shortcode()`, so set TTL to zero.
 			add_filter( 'oembed_ttl', '__return_zero', PHP_INT_MAX );

From f9bc181460d5f124a76fe9c828b35c8496a62598 Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Thu, 3 Jul 2025 14:26:47 +0200
Subject: [PATCH 4/4] Require wp-cli-tests v5

---
 composer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index 59db6ec..b172bbe 100644
--- a/composer.json
+++ b/composer.json
@@ -15,7 +15,7 @@
     },
     "require-dev": {
         "wp-cli/entity-command": "^1.3 || ^2",
-        "wp-cli/wp-cli-tests": "dev-add/phpstan-enhancements"
+        "wp-cli/wp-cli-tests": "^5"
     },
     "config": {
         "process-timeout": 7200,