Changeset 41697 for trunk/tests/phpunit/tests/customize/nav-menu-item-setting.php

Timestamp:

10/03/2017 03:43:01 AM (9 years ago)

Author:

westonruter

Message:

Customize: Provide validation feedback for invalid Custom Link URLs in nav menu items.

Props RMarks, EGregor, umangvaghela123, andrew.taylor, celloexpressions, westonruter, voldemortensen.
Fixes #32816.

File:

• trunk/tests/phpunit/tests/customize/nav-menu-item-setting.php (modified) (2 diffs)

trunk/tests/phpunit/tests/customize/nav-menu-item-setting.php

@@ -473 +473 @@
                 $this->assertNull( $setting->sanitize( 123 ) );
 
+                $valid_urls = array(
+                        'http://example.com/',
+                        'https://foo.example.com/hello.html',
+                        'mailto:nobody@example.com?subject=hi',
+                        'ftp://example.com/',
+                        'ftps://example.com/',
+                        'news://news.server.example/example.group.this',
+                        'irc://irc.freenode.net/wordpress',
+                        'gopher://example.com',
+                        'nntp://news.server.example/example.group.this',
+                        'feed://example.com/',
+                        'telnet://example.com',
+                        'mms://example.com',
+                        'rtsp://example.com/',
+                        'svn://develop.svn.wordpress.org/trunk',
+                        'tel:000-000-000',
+                        'fax:000-000-000',
+                        'xmpp:user@host?message',
+                        'webcal://example.com',
+                        'urn:org.wordpress',
+                );
+                foreach ( $valid_urls as $valid_url ) {
+                        $url_setting = $setting->sanitize( array( 'url' => $valid_url ) );
+                        $this->assertInternalType( 'array', $url_setting );
+                        $this->assertEquals( $valid_url, $url_setting['url'] );
+                }
+
+                $invalid_urls = array(
+                        'javascript:alert(1)',
+                        'unknown://something.out-there',
+                        'smtp://user:pass@mailserver.thing',
+                );
+                foreach ( $invalid_urls as $invalid_url ) {
+                        $url_setting = $setting->sanitize( array( 'url' => $invalid_url ) );
+                        $this->assertInstanceOf( 'WP_Error', $url_setting );
+                        $this->assertEquals( 'invalid_url', $url_setting->get_error_code() );
+                }
+
                 $unsanitized = array(
                         'object_id' => 'bad',
@@ -480 +518 @@
                         'type' => 'custom<b>',
                         'title' => '\o/ o\'o Hi<script>unfilteredHtml()</script>',
-                        'url' => 'javascript:alert(1)',
+                        'url' => '', // Note the javascript: protocol is checked above and results in a hard validation error, beyond mere sanitization.
                         'target' => '" onclick="',
                         'attr_title' => '\o/ o\'o <b>bolded</b><script>unfilteredHtml()</script>',