Changeset 60681 for trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php

Timestamp:

08/27/2025 10:32:57 AM (14 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php (modified) (2 diffs)

trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php

@@ -4 +4 @@
  * @group scripts
  */
-class Tests_Dependencies_LocalizeScript extends WP_UnitTestCase {
+class Tests_Dependencies_wpLocalizeScript extends WP_UnitTestCase {
         /**
          * @var WP_Scripts
@@ -39 +39 @@
                 );
         }
+
+        /**
+         * Verifies that wp_localize_script() outputs safe JSON whe harmful data is provided.
+         *
+         * @ticket 63851
+         * @covers ::wp_localize_script
+         */
+        public function test_wp_localize_script_outputs_safe_json() {
+                add_theme_support( 'html5', array( 'script' ) );
+
+                $path     = '/test.js';
+                $base_url = site_url( $path );
+
+                wp_enqueue_script( 'test-script', $path, array(), null );
+                wp_localize_script( 'test-script', 'testData', array( '<!--' => '<script>' ) );
+
+                $output = get_echo( 'wp_print_scripts' );
+
+                $expected  = "<script id=\"test-script-js-extra\">\nvar testData = {\"\\u003C!--\":\"\\u003Cscript\\u003E\"};\n</script>\n";
+                $expected .= "<script src=\"{$base_url}\" id=\"test-script-js\"></script>\n";
+
+                $this->assertEqualHTML( $expected, $output );
+        }
 }