Exclude _wpnonce URLs in speculation rules

[westonruter]

This is a sub-PR of #1142.

Fixes #1141

Before	After

The URLPattern used to exclude URLs with _wpnonce is /*\?*(^|&)_wpnonce=*. Take special note that the second * wildcard only matches chars in the query segment. Additionally, the ^ anchors the match to the beginning of the search segment, and not to the beginning of the entire string. (Remember: URLPattern is not regex.) This means that only the _wpnonce query parameter will matched, whether it is the first query parameter or not. It also won't incorrectly match other_wpnonce.

The following URLs were tested to be properly included and excluded:

URL	Status	URLPattern Tester
http://example.com/foo/?_wpnonce=1234	Excluded	Test
http://example.com/?_wpnonce=1234	Excluded	Test
http://example.com/foo/?amp=1&_wpnonce=1234	Excluded	Test
http://example.com/?amp=1&_wpnonce=1234	Excluded	Test
http://example.com/foo/?_wpnonce=1234&amp=1	Excluded	Test
http://example.com/?_wpnonce=1234&amp=1	Excluded	Test
http://example.com/?my_wpnonce=1234	Not excluded (because not _wpnonce)	Test
http://example.com/?p=1#?_wpnonce=1234	Not excluded (because in URL fragment)	Test
http://example.com/_wpnonce=1234/	Not excluded (because in path)	Test

[tunetheweb]

LGTM!

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: westonruter <[email protected]>
Co-authored-by: swissspidy <[email protected]>
Co-authored-by: tunetheweb <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[tunetheweb]

Nice thorough set of tests btw. Anyway we can add them to the plugin test suite so if someone in future isn't as robust as you, it's still covered?

[westonruter]

Anyway we can add them to the plugin test suite so if someone in future isn't as robust as you, it's still covered?

That's a good idea. I've opened #1144 to explore that.