Changeset 43813 for branches/5.0/tests/phpunit/tests/kses.php

Timestamp:

10/24/2018 01:18:38 AM (8 years ago)

Author:

pento

Message:

KSES: Allow the download attribute on <a> tags.

To avoid this being a vector for bypassing the filetypes that are allowed to be uploaded, this attribute is only allowed to be added without a value.

Props kalpshit, arshidkv12, welcher, peterwilsoncc, marina_wp, pento.
See #44724.

File:

• branches/5.0/tests/phpunit/tests/kses.php (modified) (1 diff)

branches/5.0/tests/phpunit/tests/kses.php

@@ -47 +47 @@
                         'name' => 'name',
                         'target' => '_blank',
+                        'download' => '',
                 );
 
                 foreach ( $attributes as $name => $value ) {
-                        $string = "<a $name='$value'>I link this</a>";
-                        $expect_string = "<a $name='" . trim( $value, ';' ) . "'>I link this</a>";
+                        if ( $value ) {
+                                $attr = "$name='$value'";
+                                $expected_attr = "$name='" . trim( $value, ';' ) . "'";
+                        } else {
+                                $attr = $expected_attr = $name;
+                        }
+                        $string = "<a $attr>I link this</a>";
+                        $expect_string = "<a $expected_attr>I link this</a>";
                         $this->assertEquals( $expect_string, wp_kses( $string, $allowedposttags ) );
                 }