Skip to content

Commit 23272de

Browse files
sirrealandrewserongMamaduka
authored and
jorgefilipecosta
committed
Tests: Fix HTML comparison tests (#84294)
Co-authored-by: sirreal <jonsurrell@git.wordpress.org> Co-authored-by: andrewserong <andrewserong@git.wordpress.org> Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>
1 parent 4b87545 commit 23272de

5 files changed

Lines changed: 51 additions & 31 deletions

File tree

‎backport-changelog/7.2/14092.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
https://github.com/WordPress/wordpress-develop/pull/14092
2+
3+
* https://github.com/WordPress/gutenberg/pull/84294

‎phpunit/block-bindings-test.php‎

Lines changed: 37 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -157,19 +157,13 @@ public function test_update_block_with_value_from_source( $bound_attribute, $blo
157157

158158
public function data_different_get_value_callbacks() {
159159
return array(
160-
'pass arguments to source' => array(
160+
'pass arguments to source' => array(
161161
function ( $source_args, $block_instance, $attribute_name ) {
162162
$value = $source_args['key'];
163163
return "The attribute name is '$attribute_name' and its binding has argument 'key' with value '$value'.";
164164
},
165165
"<p class=\"wp-block-paragraph\">The attribute name is 'content' and its binding has argument 'key' with value 'test'.</p>",
166166
),
167-
'unsafe HTML should be sanitized' => array(
168-
function () {
169-
return '<script>alert("Unsafe HTML")</script>';
170-
},
171-
'<p class="wp-block-paragraph">alert("Unsafe HTML")</p>',
172-
),
173167
'symbols and numbers should be rendered correctly' => array(
174168
function () {
175169
return '$12.50';
@@ -211,6 +205,35 @@ public function test_different_get_value_callbacks( $get_value_callback, $expect
211205
);
212206
}
213207

208+
/**
209+
* Tests that unsafe HTML returned by the source is sanitized.
210+
*
211+
* @covers ::register_block_bindings_source
212+
*/
213+
public function test_unsafe_html_from_source_is_sanitized() {
214+
register_block_bindings_source(
215+
self::SOURCE_NAME,
216+
array(
217+
'label' => self::SOURCE_LABEL,
218+
'get_value_callback' => function () {
219+
return '<script>alert("Unsafe HTML")</script>';
220+
},
221+
)
222+
);
223+
224+
$block_content = <<<HTML
225+
<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/source"}}}} -->
226+
<p>This should not appear</p>
227+
<!-- /wp:paragraph -->
228+
HTML;
229+
$parsed_blocks = parse_blocks( $block_content );
230+
$block = new WP_Block( $parsed_blocks[0] );
231+
$result = $block->render();
232+
233+
$processor = new WP_HTML_Tag_Processor( $result );
234+
$this->assertFalse( $processor->next_tag( 'SCRIPT' ), 'The SCRIPT element should be removed.' );
235+
}
236+
214237
/**
215238
* Tests passing `uses_context` as argument to the source.
216239
*
@@ -500,9 +523,10 @@ public function test_update_list_item_source_image_renders_after_kses() {
500523
$block_content
501524
);
502525

503-
$this->assertMatchesRegularExpression(
504-
'#<li>Bound <img[^>]*class="wp-image-42"[^>]*src="https://example\.com/inline-image\.jpg"[^>]*alt="Inline image"[^>]*/?></li>#',
526+
$this->assertEqualHTML(
527+
'<li>Bound <img class="wp-image-42" src="https://example.com/inline-image.jpg" alt="Inline image"></li>',
505528
$result,
529+
'<body>',
506530
'The source image should render in the list item content after sanitization.'
507531
);
508532
}
@@ -519,7 +543,7 @@ public function test_update_list_item_unsafe_source_markup_is_sanitized() {
519543
<!-- /wp:list-item -->
520544
HTML;
521545
$result = $this->render_list_item_with_source_value(
522-
'Bound <img src="https://example.com/inline-image.jpg" alt="Inline image" onerror="alert(1)" /> <script>alert("Unsafe HTML")</script>',
546+
'Bound <img src="https://example.com/inline-image.jpg" alt="Inline image" onerror="alert(1)" /><script>alert("Unsafe HTML")</script>',
523547
$block_content
524548
);
525549

@@ -533,9 +557,10 @@ public function test_update_list_item_unsafe_source_markup_is_sanitized() {
533557
$result,
534558
'Event handler attributes should be stripped from list item source content.'
535559
);
536-
$this->assertMatchesRegularExpression(
537-
'#<img[^>]*src="https://example\.com/inline-image\.jpg"[^>]*alt="Inline image"[^>]*/?>#',
560+
$this->assertEqualHTML(
561+
'<li>Bound <img src="https://example.com/inline-image.jpg" alt="Inline image"></li>',
538562
$result,
563+
'<body>',
539564
'Safe image markup should remain after sanitization.'
540565
);
541566
}

‎phpunit/blocks/class-wp-navigation-block-renderer-test.php‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,8 @@ public function test_gutenberg_default_block_is_enclosed_in_li_tags() {
3333
// Invoke the private method.
3434
$result = $method->invoke( $reflection, $navigation_link_block );
3535

36-
if ( is_wp_version_compatible( '7.0' ) ) {
37-
$expected = '<li class="wp-block-navigation-item wp-block-navigation-link"><a class="wp-block-navigation-item__content" href="/hello-world"><span class="wp-block-navigation-item__label">Sample Page</span></a></li>';
38-
} else {
39-
// Block markup for WP 6.9 (space before wp-block-navigation-item class)
40-
// TODO: Remove the second expected markup after WP 6.9 support is dropped and the old markup is no longer generated.
41-
$expected = '<li class=" wp-block-navigation-item wp-block-navigation-link"><a class="wp-block-navigation-item__content" href="/hello-world"><span class="wp-block-navigation-item__label">Sample Page</span></a></li>';
42-
$this->assertEquals( $expected, $result );
43-
}
36+
$expected = '<li class="wp-block-navigation-item wp-block-navigation-link"><a class="wp-block-navigation-item__content" href="/hello-world"><span class="wp-block-navigation-item__label">Sample Page</span></a></li>';
37+
$this->assertEqualHTML( $expected, $result );
4438
}
4539

4640
/**

‎phpunit/class-block-fixture-test.php‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,18 +35,10 @@ public function test_kses_doesnt_change_fixtures( $block, $filename ) {
3535

3636
$kses_block = wp_kses_post( $block );
3737

38-
// KSES adds a space at the end of self-closing tags, add it to the original to match.
39-
$block = preg_replace( '|([^ ])/>|', '$1 />', $block );
40-
41-
// KSES replaces \u005c with \\ in block comment delimiters. For some
42-
// reason this if only applied to $block, though it passes locally.
43-
$block = $this->replace_backslash( $block );
44-
$kses_block = $this->replace_backslash( $kses_block );
45-
4638
// KSES removes the last semi-colon from style attributes, remove it from the original to match.
4739
$block = preg_replace( '/style="([^"]*);"/', 'style="$1"', $block );
4840

49-
$this->assertSame( $block, $kses_block, "Failed to match $filename" );
41+
$this->assertEqualHTML( $block, $kses_block, '<body>', "Failed to match $filename" );
5042
}
5143

5244
public function data_block_fixtures() {

‎phpunit/class-wp-rest-icon-controller-test.php‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,16 @@ public function test_get_item_returns_specific_icon() {
138138
$this->assertSame( 'core/arrow-left', $data['name'] );
139139
$this->assertSame( 'Arrow Left', $data['label'] );
140140
$this->assertNotEmpty( $data['content'] );
141+
141142
$this->assertStringStartsWith(
142-
'<svg xmlns="',
143+
'<svg ',
144+
$data['content'],
145+
'Icon content should start with an SVG element'
146+
);
147+
$this->assertStringContainsString(
148+
'xmlns="http://www.w3.org/2000/svg"',
143149
$data['content'],
144-
'Icon content should match the actual SVG asset'
150+
'Icon should include the xmlns attribute'
145151
);
146152
}
147153

0 commit comments

Comments
 (0)