📝 CodeRabbit Chat: Implement requested code changes

inc/duplication/data.php

@@ -1,4 +1,4 @@
 <?php
 
 use Psr\Log\LogLevel;
 
@@ -28,7 +28,7 @@
 
 			// Copy
 			$saved_options = self::db_copy_tables($from_site_id, $to_site_id);
 			$blog_meta     = self::db_copy_blog_meta($from_site_id, $to_site_id);
 			// Update
 			self::db_update_data($from_site_id, $to_site_id, $saved_options);
 		}
@@ -306,10 +306,10 @@
 			global $wpdb;
 
 			$row = $wpdb->get_row( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
 				"SHOW KEYS FROM `{$table}` WHERE Key_name = 'PRIMARY'" // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
 			);
 
 			$cache[ $table ] = $row ? $row->Column_name : null;
 
 			return $cache[ $table ];
 		}
@@ -450,7 +450,7 @@
 			if (is_serialized($row[ $field ])) {
 				$double_serialize = false;
 				$original_value   = $row[ $field ];
-				$row[ $field ]    = @unserialize($row[ $field ]);
+				$row[ $field ]    = @unserialize($row[ $field ], ['allowed_classes' => false]);
 
 				// Safety: if unserialize failed, return the original value
 				// instead of re-serializing false — which would destroy the data.
@@ -460,7 +460,7 @@
 
 				// FOR SERIALISED OPTIONS, like in wp_carousel plugin
 				if (is_serialized($row[ $field ])) {
-					$inner_unserialized = @unserialize($row[ $field ]);
+					$inner_unserialized = @unserialize($row[ $field ], ['allowed_classes' => false]);
 
 					if (false === $inner_unserialized && 'b:0;' !== $row[ $field ]) {
 						// Inner unserialize failed — fall back to single-serialized handling.
@@ -483,7 +483,7 @@
 					foreach ($array_object as $key => $value) {
 						try {
 							$row[ $field ]->$key = $value;
 						} catch (\Throwable $exception) {
 							// ...nothing
 						}
 					}
@@ -491,7 +491,7 @@
 					$row[ $field ] = self::replace($row[ $field ], $from_string, $to_string);
 				}
 
 				$row[ $field ] = serialize($row[ $field ]);
 
 				// Pour des options comme wp_carousel...
 				if ($double_serialize) {

tests/WP_Ultimo/Duplication/MUCD_Data_Test.php

@@ -327,10 +327,33 @@ public function test_try_replace_preserves_incomplete_serialized_object() {
 		$this->assertStringContainsString($old_url, $result);
 	}
 
+	/**
+	 * Test try_replace does not instantiate objects from known classes.
+	 *
+	 * Both unserialize() calls must use allowed_classes: false so that
+	 * __wakeup() / __destruct() side-effects are never triggered, even for
+	 * classes that happen to be available in the duplication runtime. Any
+	 * serialized object must be returned verbatim (same as an incomplete class).
+	 */
+	public function test_try_replace_does_not_instantiate_known_class_objects() {
+		// stdClass is always available; without allowed_classes: false it would
+		// be instantiated and processed by the object-mutation branch.
+		$obj      = new \stdClass();
+		$obj->url = 'https://example.com/old/page';
+		$serialized = serialize($obj);
+		$row        = ['meta_value' => $serialized];
+
+		$result = \MUCD_Data::try_replace($row, 'meta_value', 'example.com/old', 'example.com/new');
+
+		// With allowed_classes: false the object becomes __PHP_Incomplete_Class
+		// and the guard returns the original serialized value unchanged.
+		$this->assertSame($serialized, $result);
+	}
+
 	/**
 	 * Test try_replace with Elementor Kit-like serialized page settings.
 	 *
-	 * Simulates the _elementor_page_settings structure for a Kit post.
+
 	 * After URL replacement, all non-URL settings must be preserved
 	 * exactly and the result must be valid serialized data.
 	 */