Context Navigation

render.php

Timestamp:

03/02/2024 02:11:53 PM (11 months ago)

Author:

swissspidy

Message:

Editor: do not expose protected post meta fields in block bindings.

Ignores meta keys which are considered protected or not registered to be shown in the REST API. Adds tests.

Props santosguillamot, swissspidy, gziolo, xknown, peterwilsoncc.
Fixes #60651.

File:

-                      r57641
+                      r57754
         );
+    }
+    /**
+     * Tests if the block content is sanitized when unsafe HTML is passed.
+     *
+     * @ticket 60651
+     *
+     * @covers ::register_block_bindings_source
+     */
+    public function test_source_value_with_unsafe_html_is_sanitized() {
+        $get_value_callback = function () {
+            return '<script>alert("Unsafe HTML")</script>';
+        };
+        register_block_bindings_source(
+            self::SOURCE_NAME,
+            array(
+                'label'              => self::SOURCE_LABEL,
+                'get_value_callback' => $get_value_callback,
+            )
+        );
+        $block_content = <<<HTML
+<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/source"}}}} -->
+<p>This should not appear</p>
+<!-- /wp:paragraph -->
+HTML;
+        $parsed_blocks = parse_blocks( $block_content );
+        $block         = new WP_Block( $parsed_blocks[0] );
+        $result        = $block->render();
+        $this->assertSame(
+            '<p>alert("Unsafe HTML")</p>',
+            trim( $result ),
+            'The block content should be updated with the value returned by the source.'
+        );
+    }
+}

Note: See TracChangeset for help on using the changeset viewer.