Ticket #43101: 43101.diff

tests/phpunit/includes/functions.php

@@ -183 +183 @@
 // Skip `setcookie` calls in auth_cookie functions due to warning:
 // Cannot modify header information - headers already sent by ...
 tests_add_filter( 'send_auth_cookies', '__return_false' );
+
+/**
+ * glob() for a pattern in subdirectories.
+ *
+ * Does not support the `GLOB_BRACE` flag.
+ *
+ * Based on https://php.net/manual/en/function.glob.php#106595, which was licensed under Creative Commons Attribution 3.0.
+ *
+ * @since 4.9.2
+ *
+ * @param string $pattern The regular expression pattern to search for.
+ * @param int    $flags   Optional. Any flags that should be passed on to `glob()`.
+ * @return array
+ */
+function glob_recursive( $pattern, $flags = 0 ) {
+        $files = glob( $pattern, $flags );
+
+        foreach ( glob( dirname( $pattern ) . '/*', GLOB_ONLYDIR | GLOB_NOSORT ) as $dir ) {
+                $files = array_merge( $files, glob_recursive( $dir . '/' . basename( $pattern ), $flags ) );
+        }
+
+        return $files;
+}

new file tests/phpunit/tests/dependencies/mediaelementjs.php

@@ +1 @@
+<?php
+
+/**
+ * @group dependencies
+ * @group scripts
+ */
+class Tests_Dependencies_MediaElementjs extends WP_UnitTestCase {
+        /**
+         * Test if the MediaElement.js Flash fallbacks have been re-added.
+         *
+         * MediaElement's Flash fallbacks were removed in WordPress 4.9.2 due to limited use cases and
+         * a history of security vulnerabilities. It's unlikely that there'll ever be a need to
+         * restore them in the future, and doing so could introduce security vulnerabilities. If you
+         * want to re-add them, please discuss that with the Security team first.
+         *
+         * @since 4.9.2
+         *
+         * @group 42720
+         */
+        function test_exclusion_of_flash() {
+                $mejs_folder = ABSPATH . WPINC . '/js/mediaelement';
+                $js_files    = glob( $mejs_folder . '/*.js' );
+                $swf_files   = glob_recursive( $mejs_folder . '/*.swf' );
+
+                /*
+                 * The path in $mejs_folder is hardcoded, so this is just a sanity check to make sure the
+                 * correct directory is used, in case it gets renamed in the future.
+                 */
+                $this->assertGreaterThan( 0, count( $js_files ) );
+
+                // Make sure the Flash files haven't been re-added accidentally.
+                $this->assertCount( 0, $swf_files );
+        }
+}