Changeset 46894 for trunk/tests/phpunit/tests/formatting/WPTargetedLinkRel.php

Timestamp:

12/12/2019 05:51:35 PM (5 years ago)

Author:

whyisjake

Message:

Prevent stored XSS through wp_targeted_link_rel().

Props: vortfu, whyisjake, peterwilsoncc, xknown, SergeyBiryukov, flaviozavan.

File:

• trunk/tests/phpunit/tests/formatting/WPTargetedLinkRel.php (modified) (4 diffs)

trunk/tests/phpunit/tests/formatting/WPTargetedLinkRel.php

@@ -39 +39 @@
     public function test_rel_with_single_quote_delimiter() {
         $content  = '<p>Links: <a href="/" rel=\'existing values\' target="_blank">Existing rel</a></p>';
-        $expected = '<p>Links: <a href="/" rel=\'existing values noopener noreferrer\' target="_blank">Existing rel</a></p>';
+        $expected = '<p>Links: <a href="/" rel="existing values noopener noreferrer" target="_blank">Existing rel</a></p>';
         $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
     }
@@ -52 +52 @@
         $content  = '<p>Links: <a href="/" rel = existing target="_blank">Existing rel</a></p>';
         $expected = '<p>Links: <a href="/" rel="existing noopener noreferrer" target="_blank">Existing rel</a></p>';
-        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
-    }
-
-    public function test_rel_value_spaced_and_no_delimiter_and_values_to_escape() {
-        $content  = '<p>Links: <a href="/" rel = existing"value target="_blank">Existing rel</a></p>';
-        $expected = '<p>Links: <a href="/" rel="existing&quot;value noopener noreferrer" target="_blank">Existing rel</a></p>';
         $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
     }
@@ -115 +109 @@
 
     /**
-     * Ensure correct quotes are used when relation attribute (rel) is missing.
+     * Ensure the content of style and script tags are not processed
      *
      * @ticket 47244
      */
-    public function test_wp_targeted_link_rel_should_use_correct_quotes() {
-        $content  = '<p>Links: <a href=\'\/\' target=\'_blank\'>No rel<\/a><\/p>';
-        $expected = '<p>Links: <a href=\'\/\' target=\'_blank\' rel=\'noopener noreferrer\'>No rel<\/a><\/p>';
-        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
-
-        $content  = '<p>Links: <a href=\'\/\' target=_blank>No rel<\/a><\/p>';
-        $expected = '<p>Links: <a href=\'\/\' target=_blank rel=\'noopener noreferrer\'>No rel<\/a><\/p>';
+    public function test_wp_targeted_link_rel_skips_style_and_scripts() {
+        $content  = '<style><a href="/" target=a></style><p>Links: <script>console.log("<a href=\'/\' target=a>hi</a>");</script><script>alert(1);</script>here <a href="/" target=_blank>aq</a></p><script>console.log("<a href=\'last\' target=\'_blank\'")</script>';
+        $expected = '<style><a href="/" target=a></style><p>Links: <script>console.log("<a href=\'/\' target=a>hi</a>");</script><script>alert(1);</script>here <a href="/" target="_blank" rel="noopener noreferrer">aq</a></p><script>console.log("<a href=\'last\' target=\'_blank\'")</script>';
         $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
     }
@@ -140 +130 @@
     }
 
+    public function test_wp_targeted_link_rel_tab_separated_values_are_split() {
+        $content  = "<p>Links: <a href=\"/\" target=\"_blank\" rel=\"ugc\t\tnoopener\t\">No rel</a></p>";
+        $expected = '<p>Links: <a href="/" target="_blank" rel="ugc noopener noreferrer">No rel</a></p>';
+        $this->assertEquals( $expected, wp_targeted_link_rel( $content ) );
+    }
+
 }