Changeset 46900 for branches/5.3/tests/phpunit/tests/blocks/block-type.php

Timestamp:

12/12/2019 06:10:56 PM (7 years ago)

Author:

whyisjake

Message:

Prevent stored XSS in the block editor.

Brings r46896 to the 5.3 branch.

Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.

File:

• branches/5.3/tests/phpunit/tests/blocks/block-type.php (modified) (1 diff)

branches/5.3/tests/phpunit/tests/blocks/block-type.php

@@ -303 +303 @@
                 // even if it detects a proper $post global it should still be false for a missing block.
                 $this->assertFalse( has_block( 'core/fake' ) );
+        }
+
+        public function test_post_has_block_serialized_name() {
+                $content = '<!-- wp:serialized /--><!-- wp:core/normalized /--><!-- wp:plugin/third-party /-->';
+
+                $this->assertTrue( has_block( 'core/serialized', $content ) );
+
+                /*
+                 * Technically, `has_block` should receive a "full" (normalized, parsed)
+                 * block name. But this test conforms to expected pre-5.3.1 behavior.
+                 */
+                $this->assertTrue( has_block( 'serialized', $content ) );
+                $this->assertTrue( has_block( 'core/normalized', $content ) );
+                $this->assertTrue( has_block( 'normalized', $content ) );
+                $this->assertFalse( has_block( 'plugin/normalized', $content ) );
+                $this->assertFalse( has_block( 'plugin/serialized', $content ) );
+                $this->assertFalse( has_block( 'third-party', $content ) );
+                $this->assertFalse( has_block( 'core/third-party', $content ) );
         }