GET product by slug query string drops encoded uri characters

[rhurley-delta]

Describe the bug
when filtering the results of wp-json/wc/v2/products by the slug query string, url encoded characters seem to be getting dropped.

So say I have a base product with the sku "zzz-zzz-123+" and the slug "zzz-zzz-123%2b" (noting here that + encodes to %2b). If I perform the request: GET /wp-json/wc/v2/products?sku=zzz-zzz-123%2b
This will give me my product in a JSON response as expected and as it ought to.

Now when I perform GET /wp-json/wc/v2/products?slug=zzz-zzz-123%2b
I get an empty response.

To Reproduce
See description.

Expected behavior
I expect that filtering by slug in the GET request should give me my product as filtering by SKU does even if the slug contains url encoded characters.

Isolating the problem (mark completed items with an [x]):

• I have deactivated other plugins and confirmed this bug occurs when only WooCommerce plugin is active.
• This bug happens with a default WordPress theme active, or Storefront.
• [ x] I can reproduce this bug consistently using the steps above.

WordPress Environment

` ### WordPress Environment ###

Home URL: Redacted
Site URL: Redacted
WC Version: 3.4.0
Log Directory Writable: ✔
WP Version: 4.9.6
WP Multisite: –
WP Memory Limit: 256 MB
WP Debug Mode: –
WP Cron: ✔
Language: en_US
External object cache: –

Server Environment

Server Info: Apache/2.4.7 (Ubuntu)
PHP Version: ❌ 5.6.30-12~ubuntu14.04.1+deb.sury.org+1 - We recommend using PHP version 7.2 or above for greater performance and security. How to update your PHP version
PHP Post Max Size: 200 MB
PHP Time Limit: 240
PHP Max Input Vars: 1000
cURL Version: 7.35.0
OpenSSL/1.0.1f

SUHOSIN Installed: –
MySQL Version: 5.7.18
Max Upload Size: 200 MB
Default Timezone is UTC: ✔
fsockopen/cURL: ✔
SoapClient: ❌ Your server does not have the SoapClient class enabled - some gateway plugins which use SOAP may not work as expected.
DOMDocument: ✔
GZip: ✔
Multibyte String: ✔
Remote Post: ✔
Remote Get: ✔

Database

WC Database Version: 3.3.5
WC Database Prefix: wp_
MaxMind GeoIP Database: ✔
Total Database Size: 591.85MB
Database Data Size: 542.54MB
Database Index Size: 49.31MB
wp_woocommerce_sessions: Data: 116.19MB + Index: 2.02MB
wp_woocommerce_api_keys: Data: 0.02MB + Index: 0.03MB
wp_woocommerce_attribute_taxonomies: Data: 0.00MB + Index: 0.01MB
wp_woocommerce_downloadable_product_permissions: Data: 0.00MB + Index: 0.00MB
wp_woocommerce_order_items: Data: 0.02MB + Index: 0.02MB
wp_woocommerce_order_itemmeta: Data: 0.15MB + Index: 0.12MB
wp_woocommerce_tax_rates: Data: 0.00MB + Index: 0.01MB
wp_woocommerce_tax_rate_locations: Data: 0.00MB + Index: 0.00MB
wp_woocommerce_shipping_zones: Data: 0.02MB + Index: 0.00MB
wp_woocommerce_shipping_zone_locations: Data: 0.02MB + Index: 0.05MB
wp_woocommerce_shipping_zone_methods: Data: 0.02MB + Index: 0.00MB
wp_woocommerce_payment_tokens: Data: 0.02MB + Index: 0.02MB
wp_woocommerce_payment_tokenmeta: Data: 0.02MB + Index: 0.03MB
wp_woocommerce_log: Data: 0.02MB + Index: 0.02MB
wp_commentmeta: Data: 0.67MB + Index: 0.05MB
wp_comments: Data: 0.13MB + Index: 0.05MB
wp_ebay_accounts: Data: 0.02MB + Index: 0.00MB
wp_ebay_auctions: Data: 132.19MB + Index: 1.02MB
wp_ebay_categories: Data: 2.52MB + Index: 0.70MB
wp_ebay_jobs: Data: 2.02MB + Index: 0.00MB
wp_ebay_log: Data: 0.02MB + Index: 0.05MB
wp_ebay_messages: Data: 0.02MB + Index: 0.00MB
wp_ebay_orders: Data: 35.52MB + Index: 0.08MB
wp_ebay_payment: Data: 0.02MB + Index: 0.00MB
wp_ebay_profiles: Data: 0.17MB + Index: 0.00MB
wp_ebay_shipping: Data: 0.02MB + Index: 0.00MB
wp_ebay_sites: Data: 0.03MB + Index: 0.00MB
wp_ebay_store_categories: Data: 0.06MB + Index: 0.03MB
wp_ebay_transactions: Data: 23.52MB + Index: 0.17MB
wp_links: Data: 0.00MB + Index: 0.00MB
wp_nf_objectmeta: Data: 0.02MB + Index: 0.00MB
wp_nf_objects: Data: 0.02MB + Index: 0.00MB
wp_nf_relationships: Data: 0.02MB + Index: 0.00MB
wp_ninja_forms_fav_fields: Data: 0.05MB + Index: 0.00MB
wp_ninja_forms_fields: Data: 0.02MB + Index: 0.00MB
wp_options: Data: 142.63MB + Index: 7.60MB
wp_postmeta: Data: 59.26MB + Index: 29.74MB
wp_posts: Data: 9.29MB + Index: 2.52MB
wp_ps_exclude: Data: 0.02MB + Index: 0.00MB
wp_ps_keyword: Data: 0.02MB + Index: 0.00MB
wp_ps_postmeta: Data: 0.22MB + Index: 0.20MB
wp_ps_posts: Data: 0.48MB + Index: 0.14MB
wp_ps_product_categories: Data: 0.02MB + Index: 0.03MB
wp_ps_product_sku: Data: 1.52MB + Index: 0.42MB
wp_ps_product_tags: Data: 0.02MB + Index: 0.03MB
wp_ps_term_relationships: Data: 0.20MB + Index: 0.19MB
wp_revslider_css: Data: 0.02MB + Index: 0.00MB
wp_revslider_layer_animations: Data: 0.02MB + Index: 0.00MB
wp_revslider_settings: Data: 0.02MB + Index: 0.00MB
wp_revslider_sliders: Data: 0.02MB + Index: 0.00MB
wp_revslider_slides: Data: 0.02MB + Index: 0.00MB
wp_revslider_static_slides: Data: 0.00MB + Index: 0.00MB
wp_rg_form: Data: 0.00MB + Index: 0.00MB
wp_rg_form_meta: Data: 0.36MB + Index: 0.00MB
wp_rg_form_view: Data: 0.21MB + Index: 0.12MB
wp_rg_incomplete_submissions: Data: 0.02MB + Index: 0.02MB
wp_rg_lead: Data: 0.05MB + Index: 0.01MB
wp_rg_lead_detail: Data: 0.11MB + Index: 0.13MB
wp_rg_lead_detail_long: Data: 0.00MB + Index: 0.00MB
wp_rg_lead_meta: Data: 0.00MB + Index: 0.00MB
wp_rg_lead_notes: Data: 0.00MB + Index: 0.00MB
wp_social_users: Data: 0.02MB + Index: 0.02MB
wp_taxonomymeta: Data: 0.02MB + Index: 0.03MB
wp_termmeta: Data: 0.08MB + Index: 0.09MB
wp_terms: Data: 0.07MB + Index: 0.13MB
wp_term_relationships: Data: 0.68MB + Index: 1.51MB
wp_term_taxonomy: Data: 0.08MB + Index: 0.08MB
wp_usermeta: Data: 0.12MB + Index: 0.09MB
wp_users: Data: 0.00MB + Index: 0.01MB
wp_wc_download_log: Data: 0.02MB + Index: 0.03MB
wp_wc_webhooks: Data: 0.02MB + Index: 0.02MB
wp_wfBadLeechers: Data: 0.02MB + Index: 0.00MB
wp_wfBlockedCommentLog: Data: 0.02MB + Index: 0.00MB
wp_wfBlockedIPLog: Data: 0.05MB + Index: 0.00MB
wp_wfBlocks7: Data: 0.02MB + Index: 0.05MB
wp_wfConfig: Data: 1.52MB + Index: 0.00MB
wp_wfCrawlers: Data: 0.02MB + Index: 0.00MB
wp_wfFileChanges: Data: 0.02MB + Index: 0.00MB
wp_wfFileMods: Data: 3.52MB + Index: 0.00MB
wp_wfHits: Data: 1.02MB + Index: 1.14MB
wp_wfHoover: Data: 0.02MB + Index: 0.02MB
wp_wfIssues: Data: 0.02MB + Index: 0.06MB
wp_wfKnownFileList: Data: 1.52MB + Index: 0.00MB
wp_wfLeechers: Data: 2.02MB + Index: 0.00MB
wp_wfLiveTrafficHuman: Data: 0.02MB + Index: 0.02MB
wp_wfLocs: Data: 0.02MB + Index: 0.00MB
wp_wfLogins: Data: 0.05MB + Index: 0.03MB
wp_wfNet404s: Data: 0.02MB + Index: 0.02MB
wp_wfNotifications: Data: 0.02MB + Index: 0.00MB
wp_wfPendingIssues: Data: 0.02MB + Index: 0.06MB
wp_wfReverseCache: Data: 0.02MB + Index: 0.00MB
wp_wfScanners: Data: 0.02MB + Index: 0.00MB
wp_wfSNIPCache: Data: 0.02MB + Index: 0.05MB
wp_wfStatus: Data: 0.13MB + Index: 0.11MB
wp_wfVulnScanners: Data: 0.02MB + Index: 0.00MB
wp_wplc_chat_msgs: Data: 0.02MB + Index: 0.00MB
wp_wplc_chat_sessions: Data: 1.52MB + Index: 0.00MB
wp_wplc_offline_messages: Data: 0.02MB + Index: 0.00MB
wp_wpmelon_advbedit_temp: Data: 1.52MB + Index: 0.00MB
wp_yith_wcwl: Data: 0.02MB + Index: 0.06MB
wp_yith_wcwl_lists: Data: 0.02MB + Index: 0.03MB
wp_yoast_seo_links: Data: 0.05MB + Index: 0.02MB
wp_yoast_seo_meta: Data: 0.02MB + Index: 0.00MB

Post Type Counts

attachment: 11476
blocks: 8
bne_testimonials: 2
colabsframework: 3
custom_css: 1
customize_changeset: 17
global_product_addon: 1
json_consumer: 1
kento-testimonial: 2
nav_menu_item: 42
oembed_cache: 8
page: 37
popup: 1
popup_theme: 1
post: 11
product: 4987
product_variation: 6672
revision: 1946
safecss: 1
shipping_zone: 1
shop_commission: 3
shop_coupon: 2
shop_order: 121
spucpt: 2
tablepress_table: 7
templatera: 1
testimonial: 2
testimonials: 1
uwpqsf: 1
vc_grid_item: 1
was: 2
wcps: 1
wpcf7_contact_form: 3

Security

Secure connection (HTTPS): ✔
Hide errors from visitors: ✔

Active Plugins (25)

Gravity Forms: by rocketgenius – 2.0.3
a3 Lazy Load: by a3rev Software – 1.8.7
a3rev Dashboard: by a3rev Software – 2.6.0 – Not tested with the active version of WooCommerce
Capability Manager Enhanced: by Jordi Canals
Kevin Behrens – 1.5.8

Gravity Forms CSS Ready Class Selector: by Brad Vincent – 1.1
Nextend Social Login: by Nextendweb – 3.0.7
Post Tags and Categories for Pages: by curtismchale – 1.4.1
WooCommerce Product Filter: by Mihajlovic Nenad – 6.5.7 – Not tested with the active version of WooCommerce
Really Simple CAPTCHA: by Takayuki Miyoshi – 2.0.1
Recent Posts Widget Extended: by Satrya – 0.9.9.7
Revolution Slider: by ThemePunch – 4.6.92
TablePress: by Tobias Bäthge – 1.9
Woocommerce Advanced Bulk Edit: by George Iron – 4.3.6 – Not tested with the active version of WooCommerce
WooCommerce Advanced Shipping Zones: by Jeroen Sormani – 1.1.1 – Not tested with the active version of WooCommerce
WooCommerce Advanced Shipping: by Jeroen Sormani – 1.0.13 – Not tested with the active version of WooCommerce
WooCommerce Brands: by WooCommerce – 1.6.1 – 1.6.2 is available – Not tested with the active version of WooCommerce
WooCommerce Predictive Search PRO: by a3rev Software – 4.6.0 – Not tested with the active version of WooCommerce
WooCommerce Quotes and Orders: by A3 Revolution – 1.3.6 – Not tested with the active version of WooCommerce
WooCommerce: by Automattic – 3.4.0
WooSidebars: by WooThemes – 1.4.3
Wordfence Security: by Wordfence – 7.1.6
Yoast SEO Premium: by Team Yoast – 7.5.1
WP-Lister Pro for eBay: by WP Lab – 2.0.39 – Not tested with the active version of WooCommerce
YITH Woocommerce Request A Quote Premium: by YITHEMES – 2.0.4
YITH WooCommerce Wishlist: by YITHEMES – 2.2.1 – Not tested with the active version of WooCommerce

Settings

API Enabled: ✔
Force SSL: ✔
Currency: AUD ($)
Currency Position: left
Thousand Separator: ,
Decimal Separator: .
Number of Decimals: 2
Taxonomies: Product Types: external (external)
grouped (grouped)
simple (simple)
variable (variable)

Taxonomies: Product Visibility: exclude-from-catalog (exclude-from-catalog)
exclude-from-search (exclude-from-search)
featured (featured)
outofstock (outofstock)
rated-1 (rated-1)
rated-2 (rated-2)
rated-3 (rated-3)
rated-4 (rated-4)
rated-5 (rated-5)

WC Pages

Shop base: #16 - Redacted
Cart: #7577 - /cart/
Checkout: #7578 - /checkout/
My account: #7579 - /my-account/
Terms and conditions: ❌ Page not set

Theme

Name: Flatsome Child
Version: 3.0
Author URL:
Child Theme: ✔
Parent Theme Name: Flatsome
Parent Theme Version: 3.5.3
Parent Theme Author URL: http://www.uxthemes.com/
WooCommerce Support: ✔

Templates

Overrides: flatsome/woocommerce/archive-product.php version 3.3.0 is out of date. The core version is 3.4.0
flatsome/woocommerce/cart/cart-empty.php
flatsome/woocommerce/cart/cart.php version 3.3.0 is out of date. The core version is 3.4.0
flatsome/woocommerce/checkout/form-checkout.php
flatsome/woocommerce/checkout/form-coupon.php version 3.3.0 is out of date. The core version is 3.4.0
flatsome/woocommerce/checkout/thankyou.php
flatsome/woocommerce/content-product.php version 3.0.0 is out of date. The core version is 3.4.0
flatsome/woocommerce/content-product_cat.php
flatsome/woocommerce/content-single-product.php version 3.0.0 is out of date. The core version is 3.4.0
flatsome/woocommerce/global/breadcrumb.php
flatsome/woocommerce/global/quantity-input.php version 3.3.0 is out of date. The core version is 3.4.0
flatsome/woocommerce/global/wrapper-end.php
flatsome/woocommerce/global/wrapper-start.php
flatsome/woocommerce/loop/loop-end.php
flatsome/woocommerce/loop/loop-start.php
flatsome/woocommerce/loop/pagination.php
flatsome/woocommerce/loop/result-count.php
flatsome/woocommerce/loop/sale-flash.php
flatsome/woocommerce/myaccount/form-login.php version 3.3.0 is out of date. The core version is 3.4.0
flatsome/woocommerce/myaccount/navigation.php
flatsome/woocommerce/notices/error.php
flatsome/woocommerce/notices/notice.php
flatsome/woocommerce/notices/success.php
flatsome-child/woocommerce/product-searchform.php version - is out of date. The core version is 3.3.0
flatsome/woocommerce/single-product/photoswipe.php
flatsome/woocommerce/single-product/price.php
flatsome/woocommerce/single-product/product-image.php
flatsome/woocommerce/single-product/product-thumbnails.php
flatsome/woocommerce/single-product/related.php
flatsome/woocommerce/single-product/review.php
flatsome/woocommerce/single-product/sale-flash.php
flatsome/woocommerce/single-product/share.php
flatsome/woocommerce/single-product/short-description.php
flatsome/woocommerce/single-product/tabs/tabs.php
flatsome/woocommerce/single-product/title.php
flatsome/woocommerce/single-product/up-sells.php
flatsome/woocommerce/single-product-reviews.php
flatsome/woocommerce/single-product.php

Outdated Templates: ❌

[rhurley-delta]

ALSO: I'd like to show that duplicate slugs can be given through the api.
I already had a product with:
sku: zzz-zzz-123+
slug: zzz-zzz-123%2b
I just added another product (note the sku is different but slug is the same):
sku: zzz-zzz-1234
slug: zzz-zzz-123%2b

and it allowed me to push this 2nd product through with no issue. Here is how the 2 products are displayed when viewing them on my admin panel.

[rhurley-delta]

ALSO: the encoded characters in these slugs are stripped / dropped when the product is published.

[mikejolley]

zzz-zzz-123+ is not a valid slug. As you said, WordPress strips invalid characters on save and it becomes zzz-zzz-123.

I tried to set an invalid slug via API and it correctly filtered it out and returned the actual slug after save:

If I set it to zzz-zzz-123%2b via admin or API, it saved first time, but as you said, if you saved it again from admin it would be stripped.

When doing that I was able to filter with ?slug=zzz-zzz-123%2b

I think the bug here is in WordPress and thats inconsistent saving of the slug field. zzz-zzz-123%2b becomes zzz-zzz-123+ on save, and then on save again it becomes zzz-zzz-123.

I could not find an existing ticket for this so I think it's best it gets logged on trac here: https://core.trac.wordpress.org/newticket Slug editing in admin is part of WordPress core so cannot be fixed exclusively from our side.

cc @claudiosanches

Thanks