Changeset 41697 for trunk/tests/phpunit/tests/customize/nav-menu-item-setting.php

Timestamp:

10/03/2017 03:43:01 AM (7 years ago)

Author:

westonruter

Message:

Customize: Provide validation feedback for invalid Custom Link URLs in nav menu items.

Props RMarks, EGregor, umangvaghela123, andrew.taylor, celloexpressions, westonruter, voldemortensen.
Fixes #32816.

File:

• trunk/tests/phpunit/tests/customize/nav-menu-item-setting.php (modified) (2 diffs)

trunk/tests/phpunit/tests/customize/nav-menu-item-setting.php

@@ -473 +473 @@
         $this->assertNull( $setting->sanitize( 123 ) );
 
+        $valid_urls = array(
+            'http://example.com/',
+            'https://foo.example.com/hello.html',
+            'mailto:nobody@example.com?subject=hi',
+            'ftp://example.com/',
+            'ftps://example.com/',
+            'news://news.server.example/example.group.this',
+            'irc://irc.freenode.net/wordpress',
+            'gopher://example.com',
+            'nntp://news.server.example/example.group.this',
+            'feed://example.com/',
+            'telnet://example.com',
+            'mms://example.com',
+            'rtsp://example.com/',
+            'svn://develop.svn.wordpress.org/trunk',
+            'tel:000-000-000',
+            'fax:000-000-000',
+            'xmpp:user@host?message',
+            'webcal://example.com',
+            'urn:org.wordpress',
+        );
+        foreach ( $valid_urls as $valid_url ) {
+            $url_setting = $setting->sanitize( array( 'url' => $valid_url ) );
+            $this->assertInternalType( 'array', $url_setting );
+            $this->assertEquals( $valid_url, $url_setting['url'] );
+        }
+
+        $invalid_urls = array(
+            'javascript:alert(1)',
+            'unknown://something.out-there',
+            'smtp://user:pass@mailserver.thing',
+        );
+        foreach ( $invalid_urls as $invalid_url ) {
+            $url_setting = $setting->sanitize( array( 'url' => $invalid_url ) );
+            $this->assertInstanceOf( 'WP_Error', $url_setting );
+            $this->assertEquals( 'invalid_url', $url_setting->get_error_code() );
+        }
+
         $unsanitized = array(
             'object_id' => 'bad',
@@ -480 +518 @@
             'type' => 'custom<b>',
             'title' => '\o/ o\'o Hi<script>unfilteredHtml()</script>',
-            'url' => 'javascript:alert(1)',
+            'url' => '', // Note the javascript: protocol is checked above and results in a hard validation error, beyond mere sanitization.
             'target' => '" onclick="',
             'attr_title' => '\o/ o\'o <b>bolded</b><script>unfilteredHtml()</script>',