Repository navigation
Conversation
…handling. Moves the unsafe HTML case out of `data_different_get_value_callbacks()` into its own test, which asserts that the rendered block contains no SCRIPT element instead of comparing the exact output. The exact output depends on whether KSES keeps or removes the text inside a removed SCRIPT element, which changed in [64233]. See #66208.
sirreal
added a commit
to WordPress/gutenberg
that referenced
this pull request
Oct 8, 2026
Assert that no SCRIPT element remains instead of comparing the exact markup, which depends on whether KSES keeps the text of a removed SCRIPT element. Core sync: WordPress/wordpress-develop#14092
sirreal
marked this pull request as ready for review
October 8, 2026 05:32
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Mamaduka
approved these changes
Oct 8, 2026
Member
|
I think this just needs to be committed. @sirreal, do you have time to handle this? |
wporg-sync
pushed a commit
that referenced
this pull request
Oct 15, 2026
Assert that the output has no SCRIPT tag, without depending on how KSES removes it. Developed in: #14092 Follow-up to r64233. Props jonsurrell, mamaduka, andrewserong. See #66208. git-svn-id: https://develop.svn.wordpress.org/trunk@64355 602fd350-edb4-49c9-b593-d223f7449a82
Member
Author
|
Merged in r64355. |
wporg-sync
pushed a commit
to WordPress/WordPress
that referenced
this pull request
Oct 15, 2026
Assert that the output has no SCRIPT tag, without depending on how KSES removes it. Developed in: WordPress/wordpress-develop#14092 Follow-up to r64233. Props jonsurrell, mamaduka, andrewserong. See #66208. Built from https://develop.svn.wordpress.org/trunk@64355 git-svn-id: http://core.svn.wordpress.org/trunk@63505 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make the Block Bindings unsafe HTML test pass whether KSES keeps or removes the text inside a removed SCRIPT element.
The
'unsafe HTML should be sanitized'case indata_different_get_value_callbacks()compared the rendered paragraph to an exact string. That string depends on how KSES handles the contents of a disallowed SCRIPT element, which changed in r64233 ("KSES: Reimplement with Tag Processor."). The test checks that the SCRIPT element is removed, not what happens to its text.This moves the case into
test_unsafe_html_from_source_is_sanitized(), which renders the bound paragraph and asserts withWP_HTML_Tag_Processorthat the output contains no SCRIPT element.This syncs with Gutenberg PR WordPress/gutenberg#84294, which makes the same change to
phpunit/block-bindings-test.php. Gutenberg PR WordPress/gutenberg#84302 applies the same fix to a Gutenberg list item test that has no counterpart in Core.Trac ticket: https://core.trac.wordpress.org/ticket/66208
Follow-up to r64233.
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Used for: The change was authored with Claude Code and reviewed by the author.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.