vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 20:30:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent stored XSS in the block editor.

Browse Source 
Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.

Props: aduth, epiqueras, 


git-svn-id: https://develop.svn.wordpress.org/trunk@46896 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jake Spurlock
2019-12-12 18:00:45 +00:00
parent 39a8eacb5f
commit 7c38cf178a
4 changed files with 271 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phpunit/tests/blocks/block-type.php
+18
View File
@@ -304,6 +304,24 @@ class WP_Test_Block_Type extends WP_UnitTestCase {
$this->assertFalse( has_block( 'core/fake' ) );
}
public function test_post_has_block_serialized_name() {
$content = '<!-- wp:serialized /--><!-- wp:core/normalized /--><!-- wp:plugin/third-party /-->';
$this->assertTrue( has_block( 'core/serialized', $content ) );
/*
* Technically, `has_block` should receive a "full" (normalized, parsed)
* block name. But this test conforms to expected pre-5.3.1 behavior.
*/
$this->assertTrue( has_block( 'serialized', $content ) );
$this->assertTrue( has_block( 'core/normalized', $content ) );
$this->assertTrue( has_block( 'normalized', $content ) );
$this->assertFalse( has_block( 'plugin/normalized', $content ) );
$this->assertFalse( has_block( 'plugin/serialized', $content ) );
$this->assertFalse( has_block( 'third-party', $content ) );
$this->assertFalse( has_block( 'core/third-party', $content ) );
}
/**
* Renders a test block without content.
*