Changeset 63380 for trunk/tests/phpunit/tests/functions/wpAdminNotice.php

Timestamp:

08/28/2026 12:04:49 AM (7 weeks ago)

Author:

dmsnell

Message:

HTML API: Refactor wp_get_admin_notice().

Refactors wp_get_admin_notice() to rely on the HTML API for HTML generation. This provides more reliable parsing and hardening for and against the provided arguments, but introduces behavioral changes that should only affect already-broken cases.

Namely, the function previously generated its output and then mandated that calling code run it through wp_kses(). This meant that certain kinds of corruption were possible which would break boundaries within the generated HTML and result in mangled output through wp_kses(). Now, the function preserves all boundaries when generating the output, meaning that wp_kses() will receive already-normalized content.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13273
Discussed in: https://core.trac.wordpress.org/ticket/65984

Props dmsnell, joedolson, johnbillion, jorbin.
See #65984.

File:

• trunk/tests/phpunit/tests/functions/wpAdminNotice.php (modified) (4 diffs)

trunk/tests/phpunit/tests/functions/wpAdminNotice.php

@@ -26 +26 @@
                 $actual = ob_get_clean();
 
-                $this->assertSame( $expected, $actual );
+                $this->assertEqualHTML( $expected, $actual );
         }
 
@@ -155 +155 @@
                                         'type' => '"><script>alert("Howdy,admin!");</script>',
                                 ),
-                                'expected' => '<div class="notice notice-">alert("Howdy,admin!");"&gt;<p>A notice with an unsafe type.</p></div>',
+                                'expected' => '<div class="notice notice-&quot;><script>alert(&quot;Howdy,admin!&quot;);</script>"><p>A notice with an unsafe type.</p></div>',
                         ),
                         'an unsafe ID'                              => array(
@@ -162 +162 @@
                                         'id' => '"><script>alert( "Howdy, admin!" );</script> <div class="notice',
                                 ),
-                                'expected' => '<div id="">alert( "Howdy, admin!" ); <div class="notice"><p>A notice with an unsafe ID.</p></div>',
+                                'expected' => '<div id="&quot;><script>alert( &quot;Howdy, admin!&quot; );</script> <div class=&quot;notice" class="notice"><p>A notice with an unsafe ID.</p></div>',
                         ),
                         'unsafe additional classes'                 => array(
@@ -169 +169 @@
                                         'additional_classes' => array( '"><script>alert( "Howdy, admin!" );</script> <div class="notice' ),
                                 ),
-                                'expected' => '<div class="notice ">alert( "Howdy, admin!" ); <div class="notice"><p>A notice with unsafe additional classes.</p></div>',
+                                'expected' => '<div class="notice &quot;><script>alert( &quot;Howdy, admin!&quot; );</script> <div class=&quot;notice"><p>A notice with unsafe additional classes.</p></div>',
                         ),
                         'a type that is not a string'               => array(