Ticket #30883: patch.diff

src/wp-includes/formatting.php

@@ -1353 +1353 @@
         if ( '' == $sanitized )
                 $sanitized = $fallback;
 
+        if ( substr_count( $sanitized, '-' ) == strlen( $sanitized ) )
+                $sanitized = $fallback;
+
         /**
          * Filter a sanitized HTML class string.
          *

tests/phpunit/tests/formatting/SanitizeHtmlClass.php

@@ +1 @@
+<?php
+
+/**
+ * @group formatting
+ */
+class Tests_Formatting_SanitizeHtmlClass extends WP_UnitTestCase {
+
+        /**
+         * @covers ::sanitize_html_class
+         */
+        public function test_fallback_empty() {
+                $result = sanitize_html_class( '' );
+                $this->assertEquals( '', $result );
+        }
+
+        /**
+         * @covers ::sanitize_html_class
+         */
+        public function test_fallback_with_only_hyphens() {
+                $result = sanitize_html_class( '---' );
+                $this->assertEquals( '', $result );
+        }
+
+        /**
+         * @covers ::sanitize_html_class
+         * @ticket 30883
+         */
+        public function test_fallback_hyphens_after_percent_encoded_octets() {
+                $s1 = sanitize_html_class( '%d0%b2%d1%82%d0%be%d1%80%d0%b0%d1%8f-%d1%80%d1%83%d0%b1%d1%80%d0%b8%d0%ba%d0%b0' );
+                $s2 = sanitize_html_class( '%d0%bf%d0%b5%d1%80%d0%b2%d0%b0%d1%8f-%d1%80%d1%83%d0%b1%d1%80%d0%b8%d0%ba%d0%b0' );
+
+                $this->assertEquals( '', $s1 );
+                $this->assertEquals( '', $s2 );
+        }
+
+}