Merge branch 'trunk' into add/wootax-306-agents-bc-guardrail

Author: Abdalsalaam

changelog.txt

@@ -1,8 +1,9 @@
 *** WooCommerce Tax Changelog ***
 
-= 3.6.8 - 2026-xx-xx =
+= 3.6.8 - 2026-07-15 =
 * Fix   - TaxJar tax lines wiped when REST API order update includes address change.
 * Fix   - Prevent fatal error on sites running WooCommerce versions without StoreApi support.
+* Fix   - Prevent unbounded growth of WooCommerce tax rate rows when checkout city contains a semicolon.
 
 = 3.6.7 - 2026-07-06 =
 * Fix   - Prevent fatal error on Atomic sites caused by incorrect path resolution when loading the API client class.

classes/class-wc-connect-taxjar-integration.php

@@ -683,7 +683,7 @@ protected function get_address( $location_type = null ) {
 		$to_country = isset( $taxable_address[0] ) && ! empty( $taxable_address[0] ) ? strtoupper( $taxable_address[0] ) : false;
 		$to_state   = isset( $taxable_address[1] ) && ! empty( $taxable_address[1] ) ? strtoupper( $taxable_address[1] ) : false;
 		$to_zip     = isset( $taxable_address[2] ) && ! empty( $taxable_address[2] ) ? $taxable_address[2] : false;
-		$to_city    = isset( $taxable_address[3] ) && ! empty( $taxable_address[3] ) ? $taxable_address[3] : false;
+		$to_city    = isset( $taxable_address[3] ) && ! empty( $taxable_address[3] ) ? self::normalize_city( $taxable_address[3] ) : false;
 		$to_street  = isset( $taxable_address[4] ) && ! empty( $taxable_address[4] ) ? $taxable_address[4] : false;
 
 		return array(
@@ -713,7 +713,7 @@ public function allow_street_address_for_matched_rates( $matched_tax_rates, $tax
 					'country'   => $country,
 					'state'     => $state,
 					'postcode'  => $postcode,
-					'city'      => strtoupper( $city ),
+					'city'      => strtoupper( self::normalize_city( $city ) ),
 					'tax_class' => $tax_class,
 				)
 			);
@@ -930,7 +930,7 @@ protected function get_backend_address() {
 		$to_country = isset( $_POST['country'] ) ? strtoupper( wc_clean( $_POST['country'] ) ) : false;
 		$to_state   = isset( $_POST['state'] ) ? strtoupper( wc_clean( $_POST['state'] ) ) : false;
 		$to_zip     = isset( $_POST['postcode'] ) ? strtoupper( wc_clean( $_POST['postcode'] ) ) : false;
-		$to_city    = isset( $_POST['city'] ) ? strtoupper( wc_clean( $_POST['city'] ) ) : false;
+		$to_city    = isset( $_POST['city'] ) ? self::normalize_city( strtoupper( wc_clean( $_POST['city'] ) ) ) : false;
 		$to_street  = isset( $_POST['street'] ) ? strtoupper( wc_clean( $_POST['street'] ) ) : false;
     // phpcs:enable WordPress.Security.NonceVerification.Missing
 
@@ -1777,6 +1777,36 @@ private function get_itemized_tax_rates( $taxes, $taxjar_taxes, $options ): arra
 		return $taxes;
 	}
 
+	/**
+	 * Normalize a city value for safe round-trips through WooCommerce's tax rate tables.
+	 *
+	 * `WC_Tax::_update_tax_rate_cities()` treats `;` as a multi-city separator (it
+	 * `explode(';', ...)`s the input), but `WC_Tax::find_rates()` queries the city
+	 * column with a single `location_code = '<CITY>'` literal — so a checkout city
+	 * containing `;` (e.g. typo'd `Casse;Berry`) gets stored as two separate location
+	 * rows (`CASSE`, `BERRY`) yet looked up as the joined string `CASSE;BERRY`.
+	 * That asymmetry causes `find_rates()` to miss on every subsequent calculation,
+	 * which makes `create_or_update_tax_rate()` insert a fresh row each checkout —
+	 * unbounded growth of `wp_woocommerce_tax_rates`. See WOOTAX-19.
+	 *
+	 * Stripping `;` (and collapsing the resulting whitespace runs) before any path
+	 * touches the tax-rate tables or the TaxJar API restores the round-trip.
+	 *
+	 * @param string $city Raw city value, possibly user-entered.
+	 * @return string Normalized city, safe for `_update_tax_rate_cities` and `find_rates`.
+	 */
+	protected static function normalize_city( $city ) {
+		if ( ! is_string( $city ) || '' === $city ) {
+			return $city;
+		}
+
+		$city = str_replace( ';', ' ', $city );
+		$city = preg_replace( '/\s+/u', ' ', $city );
+
+		// `preg_replace` returns null on malformed UTF-8 with the /u flag; cast so trim() stays safe.
+		return trim( (string) $city );
+	}
+
 	/**
 	 * Add or update WooCommerce tax rate.
 	 *
@@ -1836,7 +1866,7 @@ public function create_or_update_tax_rate( $location, $rate, $tax_class = '', $f
 				'country'   => $location['to_country'],
 				'state'     => str_replace( ' ', '', $to_state ),
 				'postcode'  => $location['to_zip'],
-				'city'      => strtoupper( $location['to_city'] ),
+				'city'      => strtoupper( self::normalize_city( $location['to_city'] ) ),
 				'tax_class' => $tax_class,
 			)
 		);
@@ -1871,7 +1901,7 @@ public function create_or_update_tax_rate( $location, $rate, $tax_class = '', $f
 			// VAT is always country wide, no need to create separate entires for each zip and city.
 			if ( 'VAT' !== $tax_rate_name ) {
 				WC_Tax::_update_tax_rate_postcodes( $rate_id, wc_normalize_postcode( wc_clean( $location['to_zip'] ) ) );
-				WC_Tax::_update_tax_rate_cities( $rate_id, wc_clean( $location['to_city'] ) );
+				WC_Tax::_update_tax_rate_cities( $rate_id, self::normalize_city( wc_clean( $location['to_city'] ) ) );
 			}
 		}
 

npm-shrinkwrap.json

@@ -1,6 +1,6 @@
 {
 	"name": "woocommerce-services",
-	"version": "3.6.7",
+	"version": "3.6.8",
 	"scripts": {
 		"start": "cross-env NODE_ENV=development CALYPSO_CLIENT=true webpack-dev-server --hot --inline --watch --content-base dist --port 8085 --host 0.0.0.0",
 		"watch": "cross-env NODE_ENV=development CALYPSO_CLIENT=true webpack --watch",

package.json

@@ -7,7 +7,7 @@ Requires Plugins: woocommerce
 Tested up to: 7.0
 WC requires at least: 10.7
 WC tested up to: 10.9
-Stable tag: 3.6.7
+Stable tag: 3.6.8
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -70,9 +70,10 @@ This plugin relies on the following external services:
 
 == Changelog ==
 
-= 3.6.8 - 2026-xx-xx =
+= 3.6.8 - 2026-07-15 =
 * Fix   - TaxJar tax lines wiped when REST API order update includes address change.
 * Fix   - Prevent fatal error on sites running WooCommerce versions without StoreApi support.
+* Fix   - Prevent unbounded growth of WooCommerce tax rate rows when checkout city contains a semicolon.
 
 = 3.6.7 - 2026-07-06 =
 * Fix   - Prevent fatal error on Atomic sites caused by incorrect path resolution when loading the API client class.

readme.txt

@@ -1753,4 +1753,116 @@ public function test_zero_amount_response_persists_real_itemized_rates() {
 		// top-level rate. This is the core guard against the zeroing-out regression.
 		$this->assertEqualsWithDelta( 6.975, array_sum( $persisted ), 0.0001, 'Existing tax rate must not be zeroed out by a $0 calculation.' );
 	}
+
+	/**
+	 * `normalize_city()` strips semicolons and collapses whitespace.
+	 *
+	 * `WC_Tax::_update_tax_rate_cities()` treats `;` as a multi-city separator,
+	 * but `WC_Tax::find_rates()` treats it as a literal character. `normalize_city()`
+	 * strips `;` (and collapses whitespace) so the round-trip stays symmetric.
+	 *
+	 * @see WOOTAX-19
+	 *
+	 * @dataProvider normalize_city_provider
+	 *
+	 * @param string $input    Raw city value to normalize.
+	 * @param string $expected Expected normalized output.
+	 */
+	public function test_normalize_city_strips_semicolons_and_normalizes_whitespace( $input, $expected ) {
+		$reflection = new ReflectionMethod( 'WC_Connect_TaxJar_Integration', 'normalize_city' );
+		$reflection->setAccessible( true );
+
+		$this->assertSame( $expected, $reflection->invoke( null, $input ) );
+	}
+
+	/**
+	 * Data provider for `test_normalize_city_strips_semicolons_and_normalizes_whitespace`.
+	 *
+	 * @return array<string, array{0: mixed, 1: mixed}>
+	 */
+	public function normalize_city_provider() {
+		return array(
+			'no semicolon — unchanged'            => array( 'New York', 'New York' ),
+			'simple semicolon between words'      => array( 'Casse;Berry', 'Casse Berry' ),
+			'semicolon with following space'      => array( 'Casse; Berry', 'Casse Berry' ),
+			'leading semicolon'                   => array( ';Casselberry', 'Casselberry' ),
+			'trailing semicolon'                  => array( 'Casselberry;', 'Casselberry' ),
+			'consecutive semicolons'              => array( 'Casse;;Berry', 'Casse Berry' ),
+			'wrapped in whitespace'               => array( '  Casselberry  ', 'Casselberry' ),
+			'tab and newline collapse to space'   => array( "Casse;\t\nBerry", 'Casse Berry' ),
+			'empty string'                        => array( '', '' ),
+			'multi-segment with mixed separators' => array( ' Casse; ;Berry ', 'Casse Berry' ),
+			'null — returned unchanged'           => array( null, null ),
+			'false — returned unchanged'          => array( false, false ),
+		);
+	}
+
+	/**
+	 * `get_backend_address()` strips a semicolon from an admin order city.
+	 *
+	 * The admin "Recalculate" path builds its taxable address from `$_POST`, so a
+	 * `;`-bearing city must be normalized there too — otherwise backend recalculations
+	 * would reintroduce the stored/looked-up asymmetry the frontend path now avoids.
+	 *
+	 * @see WOOTAX-19
+	 */
+	public function test_get_backend_address_normalizes_semicolon_city() {
+		$_POST['country']  = 'US';
+		$_POST['state']    = 'FL';
+		$_POST['postcode'] = '33033';
+		$_POST['city']     = 'Casse;Berry';
+
+		try {
+			$address = $this->invoke_protected_method( 'get_backend_address' );
+		} finally {
+			unset( $_POST['country'], $_POST['state'], $_POST['postcode'], $_POST['city'] );
+		}
+
+		$this->assertStringNotContainsString( ';', $address['to_city'], 'Backend order city must not retain a semicolon — `_update_tax_rate_cities()` would split it.' );
+		$this->assertSame( 'CASSE BERRY', $address['to_city'] );
+	}
+
+	/**
+	 * `create_or_update_tax_rate()` is idempotent across semicolon-bearing cities.
+	 *
+	 * Regression test for the unbounded `wp_woocommerce_tax_rates` growth:
+	 * `create_or_update_tax_rate()` called twice with the same semicolon-bearing
+	 * city must reuse the existing rate row instead of inserting a duplicate.
+	 *
+	 * @see WOOTAX-19
+	 */
+	public function test_create_or_update_tax_rate_does_not_duplicate_rows_for_semicolon_city() {
+		global $wpdb;
+
+		$location = array(
+			'to_country' => 'US',
+			'to_state'   => 'FL',
+			'to_zip'     => '33033',
+			'to_city'    => 'Casse;Berry',
+			'from_state' => 'FL',
+		);
+
+		// Snapshot the row count BEFORE the first call so the test isn't sensitive
+		// to fixtures/seed data (test DB might already have rates from other tests).
+		$rates_table        = $wpdb->prefix . 'woocommerce_tax_rates';
+		$initial_rate_count = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$rates_table}" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+
+		$first_id  = $this->integration->create_or_update_tax_rate( $location, 0.07, '', 1, 1, 'Tax' );
+		$second_id = $this->integration->create_or_update_tax_rate( $location, 0.07, '', 1, 1, 'Tax' );
+
+		// Same row id on both calls — find_rates() matched the second time.
+		$this->assertSame( (int) $first_id, (int) $second_id, 'Second create_or_update_tax_rate() inserted a new row instead of reusing the existing one — find_rates() city lookup is asymmetric with _update_tax_rate_cities() storage.' );
+
+		// Exactly one new row added, not two.
+		$final_rate_count = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$rates_table}" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+		$this->assertSame( $initial_rate_count + 1, $final_rate_count, 'Expected exactly one new tax rate row after two create_or_update_tax_rate() calls with the same Casse;Berry city.' );
+
+		// Stored city in the locations table should be normalized — no `;`.
+		$locations_table = $wpdb->prefix . 'woocommerce_tax_rate_locations';
+		$stored_cities   = $wpdb->get_col( $wpdb->prepare( "SELECT location_code FROM {$locations_table} WHERE tax_rate_id = %d AND location_type = %s", (int) $first_id, 'city' ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
+		$this->assertNotEmpty( $stored_cities );
+		foreach ( $stored_cities as $city ) {
+			$this->assertStringNotContainsString( ';', $city, 'Tax rate city stored with a semicolon — `_update_tax_rate_cities()` will split it and break find_rates() on subsequent lookups.' );
+		}
+	}
 }

tests/php/test-class-wc-connect-taxjar-integration.php

@@ -8,7 +8,7 @@
  * Author URI: https://woocommerce.com/
  * Text Domain: woocommerce-services
  * Domain Path: /i18n/languages/
- * Version: 3.6.7
+ * Version: 3.6.8
  * Requires Plugins: woocommerce
  * Requires PHP: 7.4
  * Requires at least: 6.9