Upd. Integrations. Improve flow on external forms.

[svfcode]

task https://app.doboard.com/1/task/54573

[codecov]

Codecov Report

❌ Patch coverage is 18.30986% with 58 lines in your changes missing coverage. Please review.
✅ Project coverage is 27.86%. Comparing base (7df905f) to head (b45d161).
⚠️ Report is 1 commits behind head on fix.

Files with missing lines	Patch %	Lines
cleantalk.php	0.00%	24 Missing ⚠️
...k/Antispam/Integrations/CleantalkExternalForms.php	30.00%	21 Missing ⚠️
inc/apbct-sync-react.php	0.00%	10 Missing ⚠️
inc/cleantalk-settings.php	0.00%	2 Missing ⚠️
lib/Cleantalk/Common/Validate.php	80.00%	1 Missing ⚠️

❌ Your patch check has failed because the patch coverage (18.30%) is below the target coverage (70.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff              @@
##                fix     #853      +/-   ##
============================================
+ Coverage     27.79%   27.86%   +0.07%     
- Complexity     6164     6179      +15     
============================================
  Files           284      284              
  Lines         25412    25442      +30     
============================================
+ Hits           7063     7090      +27     
- Misses        18349    18352       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR hardens external form handling by restricting accepted form actions to absolute http/https URLs (blocking javascript:, data:, etc.) and adds/adjusts tests to cover the new validation and improve test reliability in restricted environments.

Changes:

• Tighten URL validation (Validate::isUrl) to allow only http/https schemes.
• Enforce allowed external form action/method in CleantalkExternalForms (validate early, sanitize appropriately, restrict output protocols).
• Add test coverage for external-form action/method validation and extend URL-validation tests with common XSS scheme vectors; adjust the multi-request integration test to skip in constrained environments.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/Common/HelperTest.php	Marks multi-request success test as integration and attempts to skip when outbound HTTP isn’t available.
tests/ApbctWP/ValidateTest.php	Adds negative test cases for javascript:, data:, vbscript: URL schemes.
tests/Antispam/IntegrationsByHook/TestCleantalkExternalForms.php	New tests ensuring external form actions/methods reject dangerous schemes and invalid methods.
lib/Cleantalk/Common/Validate.php	Updates isUrl() to require http/https scheme (mitigates scheme-bypass vectors).
lib/Cleantalk/Antispam/Integrations/CleantalkExternalForms.php	Validates/sanitizes external form action & method and restricts protocol at render-time.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.