Changeset 63380 for trunk/tests/phpunit/tests/functions/wpGetAdminNotice.php

Timestamp:

08/28/2026 12:04:49 AM (6 weeks ago)

Author:

dmsnell

Message:

HTML API: Refactor wp_get_admin_notice().

Refactors wp_get_admin_notice() to rely on the HTML API for HTML generation. This provides more reliable parsing and hardening for and against the provided arguments, but introduces behavioral changes that should only affect already-broken cases.

Namely, the function previously generated its output and then mandated that calling code run it through wp_kses(). This meant that certain kinds of corruption were possible which would break boundaries within the generated HTML and result in mangled output through wp_kses(). Now, the function preserves all boundaries when generating the output, meaning that wp_kses() will receive already-normalized content.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13273
Discussed in: https://core.trac.wordpress.org/ticket/65984

Props dmsnell, joedolson, johnbillion, jorbin.
See #65984.

File:

• trunk/tests/phpunit/tests/functions/wpGetAdminNotice.php (modified) (4 diffs)

trunk/tests/phpunit/tests/functions/wpGetAdminNotice.php

@@ -22 +22 @@
          */
         public function test_should_return_admin_notice( $message, $args, $expected ) {
-                $this->assertSame( $expected, wp_get_admin_notice( $message, $args ) );
+                $this->assertEqualHTML( $expected, wp_get_admin_notice( $message, $args ) );
         }
 
@@ -151 +151 @@
                                         'type' => '"><script>alert("Howdy,admin!");</script>',
                                 ),
-                                'expected' => '<div class="notice notice-"><script>alert("Howdy,admin!");</script>"><p>A notice with an unsafe type.</p></div>',
+                                'expected' => '<div class="notice notice-&quot;><script>alert(&quot;Howdy,admin!&quot;);</script>"><p>A notice with an unsafe type.</p></div>',
                         ),
                         'an unsafe ID'                              => array(
@@ -158 +158 @@
                                         'id' => '"><script>alert( "Howdy, admin!" );</script> <div class="notice',
                                 ),
-                                'expected' => '<div id=""><script>alert( "Howdy, admin!" );</script> <div class="notice" class="notice"><p>A notice with an unsafe ID.</p></div>',
+                                'expected' => '<div id="&quot;><script>alert( &quot;Howdy, admin!&quot; );</script> <div class=&quot;notice" class="notice"><p>A notice with an unsafe ID.</p></div>',
                         ),
                         'unsafe additional classes'                 => array(
@@ -165 +165 @@
                                         'additional_classes' => array( '"><script>alert( "Howdy, admin!" );</script> <div class="notice' ),
                                 ),
-                                'expected' => '<div class="notice "><script>alert( "Howdy, admin!" );</script> <div class="notice"><p>A notice with unsafe additional classes.</p></div>',
+                                'expected' => '<div class="notice &quot;><script>alert( &quot;Howdy, admin!&quot; );</script> <div class=&quot;notice"><p>A notice with unsafe additional classes.</p></div>',
                         ),
                         'a type that is not a string'               => array(