Accept internationalized domain names in Website/URL fields

classes/models/fields/FrmFieldUrl.php

@@ -82,9 +82,11 @@ public function validate( $args ) {
 
 		$errors = array();
 
-		// Validate the url format
-		if ( $value && ! preg_match( '/^http(s)?:\/\/(?:localhost|(?:[\da-z\.-]+\.[\da-z\.-]+))/i', $value ) ) {
+		// Validate the url format. The host class allows \x80-\xff so internationalized domain names pass.
+		// Byte range by design, and no /u modifier: with /u, preg_match() returns false on invalid UTF-8.
+		if ( $value && ! preg_match( '/^http(s)?:\/\/(?:localhost|(?:[\da-z\x80-\xff\.-]+\.[\da-z\x80-\xff\.-]+))/i', $value ) ) {
 			$errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $this->field, 'invalid' );
+		// skipcq: PHP-W1067 -- $this->field is always a field object by the time validate() runs; FrmFieldType's constructor just accepts array|int|object for lazy construction elsewhere.
 		} elseif ( $this->field->required == '1' && ! $value ) { // phpcs:ignore Universal.Operators.StrictComparisons
 			$errors[ 'field' . $args['id'] ] = FrmFieldsHelper::get_error_msg( $this->field, 'blank' );
 		}

js/formidable.js

@@ -541,7 +541,10 @@ function frmFrontFormJS() {
 		let fieldID;
 		const url = field.value;
 
-		if ( url !== '' && ! /^http(s)?:\/\/(?:localhost|(?:[\da-z\.-]+\.[\da-z\.-]+))/i.test( url ) ) {
+		// Keep in sync with FrmFieldUrl::validate(), but the ranges differ by design: JS matches UTF-16
+		// code units, so it uses the u flag and a code point range where the PHP side matches raw
+		// UTF-8 bytes. PHP must NOT gain /u: preg_match() returns false on malformed UTF-8.
+		if ( url !== '' && ! /^http(s)?:\/\/(?:localhost|(?:[\da-z\u0080-\u{10FFFF}\.-]+\.[\da-z\u0080-\u{10FFFF}\.-]+))/iu.test( url ) ) {
 			fieldID = getFieldId( field, true );
 			if ( ! ( fieldID in errors ) ) {
 				errors[ fieldID ] = getFieldValidationMessage( field, 'data-invmsg' );

stubs.php

@@ -534,11 +534,306 @@
 		}
 	}
 
+	/**
+	 * DeepSource's PHP analyzer excludes the vendor directory from its scan (see the
+	 * exclude_patterns in .deepsource.toml), so it never sees PHPUnit\Framework\TestCase's real
+	 * methods even though this class extends it - that extends clause only helps PHPStan, which
+	 * does load vendor/. Every PHPUnit method the plugin's tests actually call is therefore
+	 * re-declared concretely below, with a real (if simplified) body: an empty body would trip
+	 * DeepSource's PHP-W1080, and an unused parameter would trip PHP-W1037, on every one of these.
+	 */
 	class WP_UnitTestCase_Base extends PHPUnit\Framework\TestCase {
+		/**
+		 * FrmUnitTest::setUp() replaces this with a FrmUnitTestFactory, which is what every
+		 * plugin test actually sees, so it is typed as that rather than the core WP_UnitTest_Factory.
+		 *
+		 * @var FrmUnitTestFactory
+		 */
+		protected $factory;
+
+		/**
+		 * Real PHPUnit\Framework\TestCase declares every assertion method static, so an override
+		 * has to match that or PHP fatals with "Cannot make static method ... non static".
+		 *
+		 * @param bool   $passed
+		 * @param string $message
+		 */
+		protected static function stub_check( $passed, $message = '' ) {
+			if ( ! $passed ) {
+				throw new Exception( (string) $message );
+			}
+		}
+
+		public static function assertArrayHasKey( $key, $array, string $message = '' ): void {
+			self::stub_check( is_array( $array ) && array_key_exists( $key, $array ), $message );
+		}
+
+		public static function assertArrayNotHasKey( $key, $array, string $message = '' ): void {
+			self::stub_check( ! ( is_array( $array ) && array_key_exists( $key, $array ) ), $message );
+		}
+
+		public static function assertContains( $needle, iterable $haystack, string $message = '' ): void {
+			self::stub_check( in_array( $needle, is_array( $haystack ) ? $haystack : iterator_to_array( $haystack ), false ), $message );
+		}
+
+		public static function assertNotContains( $needle, iterable $haystack, string $message = '' ): void {
+			self::stub_check( ! in_array( $needle, is_array( $haystack ) ? $haystack : iterator_to_array( $haystack ), false ), $message );
+		}
+
+		public static function assertCount( int $expected_count, $haystack, string $message = '' ): void {
+			self::stub_check( is_countable( $haystack ) && count( $haystack ) === $expected_count, $message );
+		}
+
+		public static function assertEmpty( $actual, string $message = '' ): void {
+			self::stub_check( empty( $actual ), $message );
+		}
+
+		public static function assertNotEmpty( $actual, string $message = '' ): void {
+			self::stub_check( ! empty( $actual ), $message );
+		}
+
+		public static function assertEquals( $expected, $actual, string $message = '' ): void {
+			self::stub_check( $expected == $actual, $message ); // phpcs:ignore Universal.Operators.StrictComparisons
+		}
+
+		public static function assertTrue( $condition, string $message = '' ): void {
+			self::stub_check( $condition === true, $message );
+		}
+
+		public static function assertFalse( $condition, string $message = '' ): void {
+			self::stub_check( $condition === false, $message );
+		}
+
+		public static function assertNotFalse( $condition, string $message = '' ): void {
+			self::stub_check( $condition !== false, $message );
+		}
+
+		public static function assertFileExists( string $filename, string $message = '' ): void {
+			self::stub_check( file_exists( $filename ), $message );
+		}
+
+		public static function assertGreaterThan( $expected, $actual, string $message = '' ): void {
+			self::stub_check( $actual > $expected, $message );
+		}
+
+		public static function assertGreaterThanOrEqual( $expected, $actual, string $message = '' ): void {
+			self::stub_check( $actual >= $expected, $message );
+		}
+
+		public static function assertLessThan( $expected, $actual, string $message = '' ): void {
+			self::stub_check( $actual < $expected, $message );
+		}
+
+		public static function assertLessThanOrEqual( $expected, $actual, string $message = '' ): void {
+			self::stub_check( $actual <= $expected, $message );
+		}
+
+		public static function assertInstanceOf( string $expected, $actual, string $message = '' ): void {
+			self::stub_check( $actual instanceof $expected, $message );
+		}
+
+		public static function assertNotInstanceOf( string $expected, $actual, string $message = '' ): void {
+			self::stub_check( ! ( $actual instanceof $expected ), $message );
+		}
+
+		public static function assertIsArray( $actual, string $message = '' ): void {
+			self::stub_check( is_array( $actual ), $message );
+		}
+
+		public static function assertIsBool( $actual, string $message = '' ): void {
+			self::stub_check( is_bool( $actual ), $message );
+		}
+
+		public static function assertIsObject( $actual, string $message = '' ): void {
+			self::stub_check( is_object( $actual ), $message );
+		}
+
+		public static function assertIsString( $actual, string $message = '' ): void {
+			self::stub_check( is_string( $actual ), $message );
+		}
+
+		public static function assertIsNumeric( $actual, string $message = '' ): void {
+			self::stub_check( is_numeric( $actual ), $message );
+		}
+
+		public static function assertIsNotNumeric( $actual, string $message = '' ): void {
+			self::stub_check( ! is_numeric( $actual ), $message );
+		}
+
+		public static function assertNotNull( $actual, string $message = '' ): void {
+			self::stub_check( $actual !== null, $message );
+		}
+
+		public static function assertNull( $actual, string $message = '' ): void {
+			self::stub_check( $actual === null, $message );
+		}
+
+		public static function assertSame( $expected, $actual, string $message = '' ): void {
+			self::stub_check( $expected === $actual, $message );
+		}
+
+		public static function assertNotSame( $expected, $actual, string $message = '' ): void {
+			self::stub_check( $expected !== $actual, $message );
+		}
+
+		/**
+		 * assertObjectNotHasProperty is deliberately not overridden here: PHPUnit declares it
+		 * final, so any override at all is a fatal "Cannot override final method" - not just a
+		 * signature mismatch. It is only used in test_FrmEntry.php, which this stub rewrite does
+		 * not need to cover.
+		 */
+
+		public static function assertStringContainsString( string $needle, string $haystack, string $message = '' ): void {
+			self::stub_check( strpos( $haystack, $needle ) !== false, $message );
+		}
+
+		public static function assertStringNotContainsString( string $needle, string $haystack, string $message = '' ): void {
+			self::stub_check( strpos( $haystack, $needle ) === false, $message );
+		}
+
+		public static function assertStringStartsWith( string $prefix, string $string, string $message = '' ): void {
+			self::stub_check( strncmp( $string, $prefix, strlen( $prefix ) ) === 0, $message );
+		}
+
+		public static function fail( string $message = '' ): void {
+			throw new Exception( $message );
+		}
+
+		public static function markTestSkipped( string $message = '' ): void {
+			throw new Exception( $message );
+		}
+
+		/**
+		 * Real WP_UnitTestCase_Base declares this one an instance method, not static.
+		 */
+		public function go_to( $url ) {
+			self::stub_check( is_string( $url ) );
+		}
+
+		/**
+		 * Real WP_UnitTestCase_Base declares this one an instance method, not static.
+		 */
+		public function clean_up_global_scope() {
+			self::stub_check( true );
+		}
 	}
 
 	class WP_UnitTestCase extends WP_UnitTestCase_Base {
 	}
+
+	class WP_UnitTest_Factory {
+		/**
+		 * @var WP_UnitTest_Factory_For_Post
+		 */
+		public $post;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Attachment
+		 */
+		public $attachment;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Comment
+		 */
+		public $comment;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_User
+		 */
+		public $user;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Term
+		 */
+		public $term;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Term
+		 */
+		public $category;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Term
+		 */
+		public $tag;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Bookmark
+		 */
+		public $bookmark;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Blog
+		 */
+		public $blog;
+
+		/**
+		 * @var WP_UnitTest_Factory_For_Network
+		 */
+		public $network;
+	}
+
+	/**
+	 * The leaf *_For_* classes below are deliberately left abstract with no override of
+	 * create_object()/update_object()/get_object_by_id(): they exist only so property access
+	 * like $factory->post resolves to a type that inherits create()/create_and_get(), and an
+	 * abstract class is never instantiated from this file, so leaving them unimplemented is
+	 * fine for static analysis and avoids stubbing empty method bodies DeepSource flags as
+	 * PHP-W1080 (no body) with unused-parameter findings on top.
+	 */
+	abstract class WP_UnitTest_Factory_For_Thing {
+		public $default_generation_definitions;
+		public $factory;
+
+		public function __construct( $factory, $default_generation_definitions = array() ) {
+			$this->factory                        = $factory;
+			$this->default_generation_definitions = $default_generation_definitions;
+		}
+
+		abstract public function create_object( $args );
+		abstract public function update_object( $object_id, $fields );
+		abstract public function get_object_by_id( $object_id );
+
+		public function create( $args = array(), $generation_definitions = null ) {
+			if ( $generation_definitions === null ) {
+				$generation_definitions = $this->default_generation_definitions;
+			}
+
+			return $this->create_object( array_merge( (array) $generation_definitions, $args ) );
+		}
+
+		public function create_and_get( $args = array(), $generation_definitions = null ) {
+			return $this->get_object_by_id( $this->create( $args, $generation_definitions ) );
+		}
+
+		public function create_many( $count, $args = array(), $generation_definitions = null ) {
+			return array_fill( 0, $count, $this->create( $args, $generation_definitions ) );
+		}
+	}
+
+	abstract class WP_UnitTest_Factory_For_Post extends WP_UnitTest_Factory_For_Thing {
+	}
+
+	abstract class WP_UnitTest_Factory_For_Attachment extends WP_UnitTest_Factory_For_Post {
+	}
+
+	abstract class WP_UnitTest_Factory_For_Comment extends WP_UnitTest_Factory_For_Thing {
+	}
+
+	abstract class WP_UnitTest_Factory_For_User extends WP_UnitTest_Factory_For_Thing {
+	}
+
+	abstract class WP_UnitTest_Factory_For_Term extends WP_UnitTest_Factory_For_Thing {
+	}
+
+	abstract class WP_UnitTest_Factory_For_Bookmark extends WP_UnitTest_Factory_For_Thing {
+	}
+
+	abstract class WP_UnitTest_Factory_For_Blog extends WP_UnitTest_Factory_For_Thing {
+	}
+
+	abstract class WP_UnitTest_Factory_For_Network extends WP_UnitTest_Factory_For_Thing {
+	}
 }
 
 namespace Elementor {

tests/cypress/e2e/Forms/fieldsInFormBuilder.cy.js

@@ -251,6 +251,48 @@ describe( 'Fields in the form builder', () => {
 		cy.go( 'back' );
 	} );
 
+	it( 'should accept an internationalized domain name in a Website/URL field', () => {
+		cy.openForm();
+
+		cy.log( 'Create a text field and a Website/URL field' );
+		cy.get( 'li[id="text"] a[title="Text"]' ).click( { force: true } );
+		cy.get( 'li[id="url"] a[title="Website/URL"]' ).click( { force: true } );
+
+		cy.log( 'Update form' );
+		cy.get( '#frm_submit_side_top' ).should( 'contain', 'Update' ).click( { force: true } );
+
+		cy.log( "Enabling the 'Validate this form with javascript' setting" );
+		cy.xpath( "//ul[@class='frm_form_nav']//a[contains(text(),'Settings')]" ).should( 'contain', 'Settings' ).click();
+		cy.get( '#js_validate' ).click( { force: true } );
+		cy.get( '#frm_submit_side_top' ).should( 'contain', 'Update' ).click( { force: true } );
+
+		cy.log( 'Click on Preview - Blank Page' );
+		cy.get( '#frm-previewDrop', { timeout: 5000 } ).should( 'contain', 'Preview' ).click();
+		cy.get( '.preview > .frm-dropdown-menu > :nth-child(1) > a' ).should( 'contain', 'On Blank Page' ).invoke( 'removeAttr', 'target' ).click();
+
+		/**
+		 * A host with no dot must still be rejected. This proves the javascript validator really is
+		 * running on this field, so the assertion further down cannot pass for the wrong reason.
+		 */
+		cy.log( 'A host with no dot is still rejected' );
+		cy.get( '[id^="field_"]' ).filter( 'input' ).eq( 1 ).type( 'münchen' );
+		cy.get( '[id^="field_"]' ).filter( 'input' ).eq( 0 ).click();
+		cy.get( '[id^="frm_error_field_"]' ).should( 'exist' );
+
+		/**
+		 * An accented host must be accepted. The regex runs out of the committed js/formidable.min.js,
+		 * which is rebuilt into js/frm.min.js when the plugin is activated, so a stale minified
+		 * artifact fails right here.
+		 */
+		cy.log( 'An internationalized domain name is accepted' );
+		cy.get( '[id^="field_"]' ).filter( 'input' ).eq( 1 ).clear().type( 'https://ernährung.ch' );
+		cy.get( '[id^="field_"]' ).filter( 'input' ).eq( 0 ).click();
+		cy.get( '[id^="frm_error_field_"]' ).should( 'not.exist' );
+
+		cy.log( 'Navigate back to the formidable form page' );
+		cy.go( 'back' );
+	} );
+
 	afterEach( () => {
 		cy.log( 'Teardown - Save the form and delete it' );
 		cy.get( "a[aria-label='Close']", { timeout: 10000 } ).click( { force: true } );