Fix alt text upload URL matching

includes/Abilities/Image/Alt_Text_Generation.php

@@ -333,7 +333,10 @@ protected function maybe_map_url_to_local_path( string $url ): ?string {
 		$normalized_url     = $this->normalize_upload_url( $url );
 		$normalized_baseurl = $this->normalize_upload_url( $uploads['baseurl'] );
 
-		if ( ! str_contains( $normalized_url, $normalized_baseurl ) ) {
+		if (
+			$normalized_url !== $normalized_baseurl &&
+			! str_starts_with( $normalized_url, $normalized_baseurl . '/' )
+		) {
 			return null;
 		}
 

tests/Integration/Includes/Abilities/Alt_Text_GenerationTest.php

@@ -265,6 +265,45 @@ public function test_execute_callback_returns_not_an_image() {
 		$this->assertEquals( 'not_an_image', $result->get_error_code(), 'Error code should be not_an_image' );
 	}
 
+	/**
+	 * Test that lookalike upload URLs do not map to local files.
+	 *
+	 * @since x.x.x
+	 */
+	public function test_maybe_map_url_to_local_path_rejects_lookalike_upload_url() {
+		$uploads = wp_get_upload_dir();
+		if ( empty( $uploads['baseurl'] ) || empty( $uploads['basedir'] ) ) {
+			$this->markTestSkipped( 'Uploads directory is not available.' );
+			return;
+		}
+
+		$normalized_baseurl = $this->invoke_normalize_upload_url( $uploads['baseurl'] );
+		$relative_path      = substr( $normalized_baseurl, -3 ) . '/ai-test-image.jpg';
+		$file_path          = trailingslashit( $uploads['basedir'] ) . $relative_path;
+
+		wp_mkdir_p( dirname( $file_path ) );
+		$bytes_written = file_put_contents( $file_path, 'test image' ); // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.file_ops_file_put_contents
+		if ( false === $bytes_written ) {
+			$this->markTestSkipped( 'Could not create upload fixture.' );
+			return;
+		}
+
+		$reflection = new \ReflectionClass( $this->ability );
+		$method     = $reflection->getMethod( 'maybe_map_url_to_local_path' );
+		$method->setAccessible( true );
+
+		$lookalike_url = 'https://bad' . $normalized_baseurl . '/ai-test-image.jpg';
+
+		try {
+			$this->assertNull(
+				$method->invoke( $this->ability, $lookalike_url ),
+				'Lookalike upload URLs must not resolve to local upload files.'
+			);
+		} finally {
+			wp_delete_file( $file_path );
+		}
+	}
+
 	/**
 	 * Test that permission_callback() returns true for user with upload_files when using image_url only.
 	 *
@@ -283,6 +322,22 @@ public function test_permission_callback_with_image_url_and_upload_files() {
 		$this->assertTrue( $result, 'Permission should be granted for user with upload_files when using image_url' );
 	}
 
+	/**
+	 * Invokes normalize_upload_url() for test setup.
+	 *
+	 * @since x.x.x
+	 *
+	 * @param string $url URL to normalize.
+	 * @return string Normalized URL.
+	 */
+	private function invoke_normalize_upload_url( string $url ): string {
+		$reflection = new \ReflectionClass( $this->ability );
+		$method     = $reflection->getMethod( 'normalize_upload_url' );
+		$method->setAccessible( true );
+
+		return $method->invoke( $this->ability, $url );
+	}
+
 	/**
 	 * Test that permission_callback() returns error for user without upload_files when using image_url only.
 	 *

tests/e2e/specs/admin/settings.spec.js

@@ -8,6 +8,7 @@ const { test, expect } = require( '@wordpress/e2e-test-utils-playwright' );
  */
 const {
 	clearConnectors,
+	clearCredentials,
 	seedCredentials,
 	disableExperiments,
 	disableExperiment,
@@ -75,6 +76,7 @@ test.describe( 'Plugin settings', () => {
 	} ) => {
 		// Activate the request mocking plugin.
 		await requestUtils.activatePlugin( 'e2e-test-request-mocking' );
+		await clearCredentials( requestUtils );
 
 		await visitConnectorsPage( admin );