Changeset 60681 for trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php

Timestamp:

08/27/2025 10:32:57 AM (8 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php (modified) (2 diffs)

trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php

@@ -4 +4 @@
  * @group scripts
  */
-class Tests_Dependencies_LocalizeScript extends WP_UnitTestCase {
+class Tests_Dependencies_wpLocalizeScript extends WP_UnitTestCase {
     /**
      * @var WP_Scripts
@@ -39 +39 @@
         );
     }
+
+    /**
+     * Verifies that wp_localize_script() outputs safe JSON whe harmful data is provided.
+     *
+     * @ticket 63851
+     * @covers ::wp_localize_script
+     */
+    public function test_wp_localize_script_outputs_safe_json() {
+        add_theme_support( 'html5', array( 'script' ) );
+
+        $path     = '/test.js';
+        $base_url = site_url( $path );
+
+        wp_enqueue_script( 'test-script', $path, array(), null );
+        wp_localize_script( 'test-script', 'testData', array( '<!--' => '<script>' ) );
+
+        $output = get_echo( 'wp_print_scripts' );
+
+        $expected  = "<script id=\"test-script-js-extra\">\nvar testData = {\"\\u003C!--\":\"\\u003Cscript\\u003E\"};\n</script>\n";
+        $expected .= "<script src=\"{$base_url}\" id=\"test-script-js\"></script>\n";
+
+        $this->assertEqualHTML( $expected, $output );
+    }
 }