Fix apostrophe encoding in classic checkout requests - #68365

Trunk gained #68365, which reworked the same Jest suite this branch
extends: it encodes apostrophes in every classic checkout request body
and restructures the mock harness to reach the coupon endpoints. The
harness changes collided with the notice-classification tests here.

Resolve the test file onto trunk's harness rather than either side's
copy. Trunk's version is the more capable one - it stores delegated
document.body handlers by selector, keeps a stable coupon form mock,
collects every jQuery.ajax call instead of only the last, and scopes
fake timers to the describe blocks that need them.

Port this branch's additions on top: the notice group and checkout
field mocks, $form.prepend, jQuery.isEmptyObject and
jQuery.scroll_to_notices, and the three "Checkout update notices"
tests, now reading the update_order_review request out of trunk's
capturedAjaxRequests array and declaring their own fake timers.

Verified all 13 tests pass, and mutation-tested both sides: removing
either result guard in checkout.js fails the notice tests, and dropping
encodeApostrophes fails the serialization tests.

Refs #40443

Some security intermediaries reject request bodies that contain a
literal apostrophe before WooCommerce sees them. encodeURIComponent()
leaves ' unescaped, so jQuery's serialize() and $.param() both send it
as typed. #68365 fixed this for the classic checkout and left the cart
page for a follow-up.

Percent-encode apostrophes at the request-body boundary in cart.js:
after serialize() for the shipping calculator, update_cart() and
quantity_update(), and after $.param() for apply_coupon() and
remove_coupon_clicked(). The encodeApostrophes() helper is a verbatim
copy of the one in checkout.js; sharing it would need a new script
handle and an extra request on both pages. PHP decodes %27 back to '
when it populates $_POST, so every handler receives the same values as
before. The coupon endpoints now pass a string to $.ajax instead of a
plain object, the same change #68365 made for the checkout coupon
endpoints.

This reverts commit 975cd3b (#68365).

It restores the 11.1 request shape. update_order_review, apply_coupon
and remove_coupon pass a data object to $.ajax() again, so fields
removed with checkout field filters are dropped instead of being sent
as empty values that blank the customer's country, state and postcode.
Third-party ajaxPrefilter callbacks get the data object again rather
than a pre-serialized string. Place order sends $form.serialize() as
before.

The #68365 tests are replaced with tests for the restored request
shape. The apostrophe encoding will be re-landed separately.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…kout requests (#69649)

Revert apostrophe encoding in classic checkout requests (#69644)

This reverts commit 975cd3b (#68365).

It restores the 11.1 request shape. update_order_review, apply_coupon
and remove_coupon pass a data object to $.ajax() again, so fields
removed with checkout field filters are dropped instead of being sent
as empty values that blank the customer's country, state and postcode.
Third-party ajaxPrefilter callbacks get the data object again rather
than a pre-serialized string. Place order sends $form.serialize() as
before.

The #68365 tests are replaced with tests for the restored request
shape. The apostrophe encoding will be re-landed separately.

Co-authored-by: Michal Iwanow <4765119+mcliwanow@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Revert apostrophe encoding in classic cart requests

This reverts commit 21a50fa (#68556).

#68556 made the classic cart send apply_coupon and remove_coupon data
as a pre-serialized string (encodeApostrophes( $.param( data ) ))
instead of a data object. That is the same shape #68365 introduced on
the classic checkout, which 11.2.0 shipped and #69644 reverted in
11.2.1: third-party jQuery.ajaxPrefilter callbacks that read
originalOptions.data as an object get a string. HurryTimer's coupon
expiry check is one example; with a string it no longer blocks an
expired coupon.

#68556 is on trunk only, so without this revert it ships in 11.3.0.
Reverting restores the 11.2 cart request shape for all five request
sites, removes the encodeApostrophes() helper and its tests, and
replaces the unreleased fix changelog entry with a dev entry.

The apostrophe encoding itself is tracked separately in #69679 and
will only land if it is shown to be safe.

Refs #68395

* Drop the dev changelog entry from the cart revert

The revert already deletes the unreleased fix entry that #68556 added,
which is the only changelog file the change ever produced. Nothing
shipped, so there is nothing for the release notes to say, and the
changelog check passes because the PR touches the changes directory.
The branch now matches a plain git revert of #68556.

Refs #68395

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…m encoding

The classic cart and checkout send their AJAX bodies through jQuery,
which serializes with encodeURIComponent() and leaves !'()~ literal. A
browser submitting the same form without JavaScript percent-encodes
those five characters, and some WAF rules (Sucuri in #40791) reject the
literal apostrophe. The first fix (#68365, #68556) serialized in the
callers and shipped in 11.2.0; it turned removed address fields into
empty values and handed prefilters a string, so it was reverted
(#69644, #69696). The prefilter re-land on this branch kept
originalOptions.data intact but still only replaced the apostrophe,
assumed jQuery serializes before prefilters run, and called
jQuery.ajaxPrefilter() unguarded.

Order attribution puts "(none)" in every update_order_review body, so a
rule on parentheses blocks the classic checkout at page load; encoding
the apostrophe alone leaves that in place. jQuery 4.0.0 runs prefilters
before jQuery.param(); WordPress core still ships 3.7.1 and is
evaluating 4.x, and once it moves, object data would reach the
prefilter untouched and six of the ten requests would go out unencoded
with no test to notice. A slim jQuery build has no ajaxPrefilter(), so
the unguarded call threw and took the rest of woocommerce.js with it on
every page. A json prefilter that rewrote the body before ours would
have had its JSON mangled.

The prefilter now matches the browser's form serializer for the whole
set (!'()~ become %21 %27 %28 %29 %7E), only when the body is
application/x-www-form-urlencoded and processData is on, serializes
plain object data itself from the copy jQuery already made (so removed
fields stay dropped on jQuery 4 too), and registers only when
jQuery.ajaxPrefilter exists. The opt-in option is renamed from
wc_encode_apostrophes to wc_form_encoding to describe that contract;
the old name never shipped. The real-jQuery pipeline test now runs on
3.7.1 and 4.0.0 (devDependency alias jquery4) and asserts the body
equals URLSearchParams output.

Refs #40791
Refs #68395

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

…69679)

* fix(checkout): Encode apostrophes through a jQuery ajax prefilter

Some web application firewalls reject request bodies that carry a
literal apostrophe, so a shopper whose email or city contains one
cannot get past the classic checkout's update_order_review call.
PR #68365 (11.2.0) fixed that by serializing the data with $.param()
and encoding the string before handing it to $.ajax(). That changed
two things jQuery's own serialization used to guarantee: undefined
values (fields removed from the form by a filter) became empty keys
that cleared the customer's country, state and address on every
refresh, and prefilters that read originalOptions.data as an object
(HurryTimer, Global Seller Services) got a string. The checkout half
was reverted in #69644; cart.js still carried the same shape from
#68556.

Pass the data to $.ajax() as before and register one ajaxPrefilter in
woocommerce.js, a dependency of both wc-checkout and wc-cart, that
encodes apostrophes in the already-serialized body of requests that
opt in with the wc_encode_apostrophes option. jQuery serializes the
request first, so removed fields stay out of the body and other
prefilters see the original object. Only WooCommerce's own cart and
checkout calls set the option; third-party scripts can set it on
their own requests. PHP decodes the body once, so $_POST is unchanged.

Jest covers the prefilter, the opt-in on every call site, and the
object-shaped bodies. Validated on a dev store against HurryTimer,
FOX Currency Switcher, the Global Seller Services prefilter, a global
beforeSend and the field-removal snippets from the 11.2.0 reports.

Refs #40791

* Add changelog entry for the apostrophe encoding prefilter

* test(checkout): Cover the apostrophe prefilter with real jQuery

The prefilter design depends on jQuery's request order: copy the
options (dropping undefined fields), serialize, then run prefilters.
The existing Jest tests mock jQuery, so that order was only checked by
hand. Add jquery 3.7.1 (the version WordPress ships) as a dev
dependency of the classic assets package and a test that runs
woocommerce.js through the real pipeline with a fake XMLHttpRequest:
removed fields stay out of the body, nested data survives, apostrophes
reach the wire as %27, a later prefilter still gets the original object,
a global beforeSend and an ajaxSend handler keep working, and a
beforeSend that returns false still aborts.

Also assert the update_shipping_method request in the cart suite, which
was the one request site without a test, and say in the woocommerce.js
docblock that later prefilters and beforeSend handlers see the encoded
string in options.data.

Refs #40791

* test(checkout): Shorten the shipping method selector line in the cart test

The cart test compared the chosen shipping methods selector inline,
which left a 148-character line. The branch lint job enforces ESLint's
140-character max-len, so the Lint check failed on the PR.

Move the selector into a top-level constant next to the other
fixtures, split across short string pieces. The test logic is
unchanged.

Refs #40791

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(checkout): Say which prefilters see the encoded apostrophes

The prefilter docblock said every prefilter registered after it sees
the encoded body. In jQuery 3.7.1 that is not quite true: prefilters
for the request's own data type (json on checkout submit, html on cart
requests) run before the '*' list, and a '*' prefilter added with the
'+' flag is put in front of ours. Both still see the raw apostrophes,
as on 11.2.1, so only the comment was wrong.

The pipeline test also claimed plugin scripts always load after
woocommerce.js. The script loads with the default defer strategy, so a
plugin script in the head can register first. The comment now only
says the test prefilter is added after ours.

Refs #40791

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(checkout): Drop the beforeSend abort test that only covers jQuery

The test set a global beforeSend that returns false and asserted that
nothing reached the transport. jQuery runs beforeSend after every
prefilter and the prefilter never touches the abort path, so the test
kept passing with the prefilter's encoding removed. It could only fail
on a jQuery bug. The abort case stays covered by the store validation
recorded in the PR.

Refs #40791

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(classic-assets): send cart and checkout requests with browser form encoding

The classic cart and checkout send their AJAX bodies through jQuery,
which serializes with encodeURIComponent() and leaves !'()~ literal. A
browser submitting the same form without JavaScript percent-encodes
those five characters, and some WAF rules (Sucuri in #40791) reject the
literal apostrophe. The first fix (#68365, #68556) serialized in the
callers and shipped in 11.2.0; it turned removed address fields into
empty values and handed prefilters a string, so it was reverted
(#69644, #69696). The prefilter re-land on this branch kept
originalOptions.data intact but still only replaced the apostrophe,
assumed jQuery serializes before prefilters run, and called
jQuery.ajaxPrefilter() unguarded.

Order attribution puts "(none)" in every update_order_review body, so a
rule on parentheses blocks the classic checkout at page load; encoding
the apostrophe alone leaves that in place. jQuery 4.0.0 runs prefilters
before jQuery.param(); WordPress core still ships 3.7.1 and is
evaluating 4.x, and once it moves, object data would reach the
prefilter untouched and six of the ten requests would go out unencoded
with no test to notice. A slim jQuery build has no ajaxPrefilter(), so
the unguarded call threw and took the rest of woocommerce.js with it on
every page. A json prefilter that rewrote the body before ours would
have had its JSON mangled.

The prefilter now matches the browser's form serializer for the whole
set (!'()~ become %21 %27 %28 %29 %7E), only when the body is
application/x-www-form-urlencoded and processData is on, serializes
plain object data itself from the copy jQuery already made (so removed
fields stay dropped on jQuery 4 too), and registers only when
jQuery.ajaxPrefilter exists. The opt-in option is renamed from
wc_encode_apostrophes to wc_form_encoding to describe that contract;
the old name never shipped. The real-jQuery pipeline test now runs on
3.7.1 and 4.0.0 (devDependency alias jquery4) and asserts the body
equals URLSearchParams output.

Refs #40791
Refs #68395

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test(classic-assets): make each prefilter guard fail its own test

Review of the form encoding prefilter found that the two "non-form body"
unit tests set both processData: false and a non-form content type, so
either guard could be removed with every test still passing, and that
nothing exercised the traditional pass-through or array data on the
jQuery 4 path, where the prefilter serializes the data itself.

Split the unit cases so each one differs from a WooCommerce request in
one setting only, and add two pipeline cases on real jQuery: traditional
array serialization (ids=1&ids=2) and serializeArray()-shaped data.
Each of the four tests now fails only when its own code path is removed.
Drop the unit test that passed originalOptions to a prefilter that never
reads it; the pipeline suite checks that contract with real jQuery on
both versions.

Refs #40791

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test(classic-assets): wrap a long expected body in the prefilter pipeline test

The plugin-level ESLint config CI runs on changed files enforces
max-len 140, and the serialized-body expectation ran to 169 characters.
Split the string literal across two lines.

Refs #40791

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>