' ), + 'Unclosed SVG TITLE after P in STRONG' => array( '<strong><p><svg ><title>' ), + ); + } + + /** + * Ensures that normalized fuzzer-discovered inputs are idempotent. + * + * @ticket 65372 + * + * @dataProvider data_provider_normalized_fuzzer_cases_that_should_be_idempotent + * + * @param string $input HTML input. + */ + public function test_normalized_fuzzer_cases_should_be_idempotent( string $input ) { + $errors = array(); + set_error_handler( + static function ( int $errno, string $errstr ) use ( &$errors ) { + $errors[] = "{$errno}: {$errstr}"; + return true; + } + ); + + try { + $normalized = WP_HTML_Processor::normalize( $input ); + $normalized_twice = is_string( $normalized ) ? WP_HTML_Processor::normalize( $normalized ) : null; + } finally { + restore_error_handler(); + } + + // Use assertSame() instead of assertEmpty() so PHPUnit shows captured error messages on failure. + $this->assertSame( array(), $errors ); + $this->assertIsString( $normalized, 'Input HTML should normalize successfully.' ); + $this->assertSame( + $normalized, + $normalized_twice, + 'Normalizing already-normalized HTML should not change it.' + ); + } + + /** + * Data provider. + * + * @return array[] + */ + public static function data_provider_normalized_fuzzer_cases_that_should_be_idempotent() { + return array( + 'Malformed quoted attribute boundary' => array( '<A "/=>' ), + 'Duplicate attribute after bare attribute' => array( '<A V=5 R V=""=>' ), + 'Duplicate DATA-ID after numeric attribute' => array( '<E DATA-ID=1 1 DATA-ID=""=>' ), + 'Duplicate attribute before tag end' => array( '<R V=5 R V=5 =>' ), + 'NULL byte in foreign tag name' => array( "<SVG><L\x00 D>" ), + 'Malformed closing-looking attribute' => array( '<a </=>' ), + 'Malformed self-closing attribute' => array( '<a h/=>' ), + 'Duplicate ID with quote boundary' => array( '<d ID=""" ID=""=>' ), + 'Mixed-case duplicate TITLE' => array( "<d TITLE=\"\"' title=\"\"=>" ), + 'Colon before self-closing slash' => array( '<e :/=>' ), + 'Duplicate class after bare attribute' => array( "<e class=y d class=''=>" ), + 'Duplicate DATA-ID after hyphen' => array( '<e data-id=1 - data-id="">' ), + 'Duplicate title after quotes' => array( "<e title=''' title=\"\"=>" ), + 'FORM with SVG TITLE text edge' => array( "<form ><svg ><title \"'></form><form>" ), + 'FORM with TABLE and SCRIPT' => array( '<form id><table te"><script></script><td srce" ID/></form><form claslicate">' ), + 'FORM with TABLE CAPTION' => array( '<form><table><caption></form><form >' ), + 'Short malformed G attribute C' => array( '<g c/=>' ), + 'Short malformed G attribute S' => array( '<g s/=>' ), + 'Duplicate SRC boundary' => array( '<g src=""g src="">' ), + 'Short malformed H attribute' => array( '<h f/=>' ), + 'Malformed SRC equals boundary' => array( '<i src=""= src=""=">' ), + 'Malformed slash in tag opener' => array( '<i/t/=>' ), + 'Malformed L colon attribute' => array( '<l :/=>' ), + 'Malformed L less-than attribute' => array( '<l/</=>' ), + 'Malformed N less-than attribute' => array( '<n </=>' ), + 'Unclosed SVG TITLE after P' => array( '<p><svg><title>' ), + 'Duplicate ALT boundary' => array( '<r alt=\'\'d alt=""=>' ), + 'NULL byte in SVG child tag' => array( "<svg><l\x00 '>" ), + 'NULL byte before slash in SVG child tag' => array( "<svg><l\x00/r>" ), + 'XMP generic raw text' => array( "<xmp> < > & \" ' \x00 </xmp>" ), + ); + } + + /** + * Ensures that carriage returns are correctly serialized. + * + * @ticket 65372 + * + * @dataProvider data_provider_carriage_returns + * + * @param string $input HTML input containing a decoded carriage return. + * @param string $expected Expected normalized output. + */ + public function test_normalize_serializes_decoded_carriage_returns_as_character_references( string $input, string $expected ): void { + $normalized = WP_HTML_Processor::normalize( $input ); + + $this->assertSame( $expected, $normalized, 'Should have serialized the carriage return as a character reference.' ); + $this->assertSame( + $expected, + WP_HTML_Processor::normalize( $normalized ), + 'Normalizing already-normalized HTML should not change the serialized carriage return.' + ); + } + + /** + * Data provider. + * + * @return array<string, array{string, string}> + */ + public static function data_provider_carriage_returns(): array { + return array( + 'Decimal character reference' => array( 'a b', 'a b' ), + 'Hex character reference' => array( 'a b', 'a b' ), + 'RCDATA title' => array( '<title>a b', 'a b' ), + 'Attribute value' => array( '', '' ), + 'Table text' => array( 'x ', 'x ' ), + 'Template text' => array( 'a b', 'a b' ), + 'Raw CR' => array( "", "" ), + 'Raw CRLF pair' => array( "", "" ), + ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_provider_normalize_special_leading_newline_cases(): array { return array( 'Leading newline in PRE' => array( "\nline 1\nline 2", - "line 1\nline 2", + "\nline 1\nline 2", ), 'Double leading newline in PRE' => array( "\n\nline 2\nline 3", @@ -357,7 +805,7 @@ public static function data_provider_normalize_special_leading_newline_cases() { ), 'Multiple text nodes inside PRE' => array( "\nline 1 still line 1", - 'line 1 still line 1', + "\nline 1 still line 1", ), 'Multiple text nodes inside PRE with leading newlines' => array( "\n\nline 2 still line 2", @@ -365,7 +813,7 @@ public static function data_provider_normalize_special_leading_newline_cases() { ), 'Leading newline in LISTING' => array( "\nline 1\nline 2", - "line 1\nline 2", + "\nline 1\nline 2", ), 'Double leading newline in LISTING' => array( "\n\nline 2\nline 3", @@ -373,7 +821,7 @@ public static function data_provider_normalize_special_leading_newline_cases() { ), 'Multiple text nodes inside LISTING' => array( "\nline 1 still line 1", - 'line 1 still line 1', + "\nline 1 still line 1", ), 'Multiple text nodes inside LISTING with leading newlines' => array( "\n\nline 2 still line 2", @@ -381,12 +829,28 @@ public static function data_provider_normalize_special_leading_newline_cases() { ), 'Leading newline in TEXTAREA' => array( "\nline 1\nline 2", - "line 1\nline 2", + "\nline 1\nline 2", ), 'Double leading newline in TEXTAREA' => array( "\n\nline 2\nline 3", "\n\nline 2\nline 3", ), + 'Foreign MathML TEXTAREA does not ignore leading newlines' => array( + 'X', + 'X', + ), + 'Foreign MathML TEXTAREA preserves leading newline' => array( + "\nX", + "\nX", + ), + 'Foreign SVG TEXTAREA does not ignore leading newlines' => array( + 'X', + 'X', + ), + 'Foreign SVG TEXTAREA preserves leading newline' => array( + "\nX", + "\nX", + ), ); } } diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessor.php b/tests/phpunit/tests/html-api/wpHtmlProcessor.php index a89014282df73..f3b051ca3639e 100644 --- a/tests/phpunit/tests/html-api/wpHtmlProcessor.php +++ b/tests/phpunit/tests/html-api/wpHtmlProcessor.php @@ -303,16 +303,18 @@ public function test_expects_closer_expects_no_closer_for_self_contained_tokens( /** * Data provider. * - * @return array[] + * @return array */ - public static function data_self_contained_node_tokens() { + public static function data_self_contained_node_tokens(): array { $self_contained_nodes = array( - 'Normative comment' => array( '' ), - 'Comment with invalid closing' => array( '' ), - 'CDATA Section lookalike' => array( '' ), - 'Processing Instruction lookalike' => array( '' ), - 'Funky comment' => array( '' ), - 'Text node' => array( 'Trombone' ), + 'Normative comment' => array( '' ), + 'Comment with invalid closing' => array( '' ), + 'CDATA Section lookalike' => array( '' ), + 'Processing Instruction' => array( '' ), + 'Bogus PI-lookalike xml comment' => array( '' ), + 'Bogus comment' => array( '' ), + 'Funky comment' => array( '' ), + 'Text node' => array( 'Trombone' ), ); foreach ( self::data_void_tags_not_ignored_in_body() as $tag_name => $_name ) { @@ -583,6 +585,29 @@ public function test_expects_closer_foreign_content_self_closing() { $this->assertTrue( $processor->expects_closer() ); } + /** + * Ensures a slash-only unquoted attribute value does not close foreign content. + * + * @ticket 65372 + */ + public function test_unquoted_slash_attribute_does_not_self_close_foreign_content(): void { + $processor = WP_HTML_Processor::create_fragment( 'math:mi is not self-closing, it has [a="/"] attribute.' ); + + $this->assertTrue( $processor->next_tag( 'MI' ), 'Failed to find the MI tag: check test setup.' ); + $this->assertSame( '/', $processor->get_attribute( 'a' ), 'Failed to treat the slash as the unquoted attribute value.' ); + $this->assertFalse( + $processor->has_self_closing_flag(), + 'Failed to avoid interpreting the slash-only unquoted attribute value as a self-closing flag.' + ); + + $this->assertTrue( $processor->next_token(), 'Failed to find text following the MI tag: check test setup.' ); + $this->assertSame( + array( 'HTML', 'BODY', 'MATH', 'MI', '#text' ), + $processor->get_breadcrumbs(), + 'Failed to keep text following the MI tag inside the MI element.' + ); + } + /** * Ensures that expects_closer works for void-like elements in foreign content. * @@ -621,7 +646,7 @@ public function test_foreign_content_script_self_closing() { /** * Ensures that the HTML Processor correctly handles TEMPLATE tag closing and namespaces. * - * This is a tricky test case that corresponds to the html5lib tests "template/line1466". + * This is a tricky test case that corresponds to the Web Platform Tests fixture "template/line1466". * * When the `` token is reached it is in the HTML namespace (thanks to the * SVG `foreignObject` element). It is not handled as foreign content; therefore, it @@ -629,7 +654,7 @@ public function test_foreign_content_script_self_closing() { * SVG `TEMPLATE` element (the second `` token). * * The test is included here because it may show up as unsupported markup and be skipped by - * the html5lib test suite. + * the Web Platform Tests suite. * * @ticket 61576 */ @@ -642,6 +667,26 @@ public function test_template_tag_closes_html_template_element() { $this->assertSame( array( 'HTML', 'BODY', 'DIV' ), $processor->get_breadcrumbs() ); } + /** + * Ensures foreign TEMPLATE elements do not satisfy HTML template handling. + * + * @ticket 65372 + */ + public function test_unmatched_template_closer_after_mathml_template_is_ignored() { + $processor = WP_HTML_Processor::create_fragment( 'here' ); + + $this->assertTrue( $processor->next_tag( 'C' ), 'Failed to find C tag.' ); + $this->assertTrue( $processor->next_token(), 'Failed to advance past the C tag.' ); + + // Closing HTML tag should be ignored, advancing to "here" text without modifying breadcrumbs. + $this->assertSame( '#text', $processor->get_token_type(), 'Failed to reach text node.' ); + $this->assertSame( 'here', $processor->get_modifiable_text() ); + $this->assertSame( + array( 'HTML', 'BODY', 'MATH', 'TEMPLATE', 'MI', 'C', '#text' ), + $processor->get_breadcrumbs(), + ); + } + /** * Ensures that the tag processor is case sensitive when removing CSS classes in no-quirks mode. * @@ -1071,11 +1116,11 @@ public function test_ensure_next_token_method_extensibility( $html, $expected_to * @ticket 62427 */ public function test_next_tag_lowercase_tag_name() { - // The upper case is irrelevant but illustrates the case-insentivity. + // The upper case is irrelevant but illustrates the case-insensitivity. $processor = WP_HTML_Processor::create_fragment( '' ); $this->assertTrue( $processor->next_tag( array( 'tag_name' => 'div' ) ) ); - // The upper case is irrelevant but illustrates the case-insentivity. + // The upper case is irrelevant but illustrates the case-insensitivity. $processor = WP_HTML_Processor::create_fragment( '' ); $this->assertTrue( $processor->next_tag( array( 'tag_name' => 'rect' ) ) ); } diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessorBreadcrumbs.php b/tests/phpunit/tests/html-api/wpHtmlProcessorBreadcrumbs.php index 911fa8b910b37..b54fc047ab040 100644 --- a/tests/phpunit/tests/html-api/wpHtmlProcessorBreadcrumbs.php +++ b/tests/phpunit/tests/html-api/wpHtmlProcessorBreadcrumbs.php @@ -49,7 +49,7 @@ public static function data_single_tag_of_supported_elements() { 'BASE', 'BDI', 'BDO', - 'BGSOUND', // Deprectated. + 'BGSOUND', // Deprecated. 'BIG', 'BLINK', // Deprecated. 'BR', diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessorComments.php b/tests/phpunit/tests/html-api/wpHtmlProcessorComments.php index 0cc4fdb0938fa..79dd8c204c111 100644 --- a/tests/phpunit/tests/html-api/wpHtmlProcessorComments.php +++ b/tests/phpunit/tests/html-api/wpHtmlProcessorComments.php @@ -32,17 +32,20 @@ public function test_comment_processing( $html, $expected_comment_type, $expecte /** * Data provider. * - * @return array[] + * @return array */ - public static function data_comments() { + public static function data_comments(): array { return array( - 'Normative comment' => array( '', WP_HTML_Processor::COMMENT_AS_HTML_COMMENT, ' A comment. ' ), - 'Abruptly closed comment' => array( '', WP_HTML_Processor::COMMENT_AS_ABRUPTLY_CLOSED_COMMENT, '' ), - 'Invalid HTML comment !' => array( '', WP_HTML_Processor::COMMENT_AS_INVALID_HTML, ' Bang opener ' ), - 'Invalid HTML comment ?' => array( '', WP_HTML_Processor::COMMENT_AS_INVALID_HTML, ' Question opener ' ), - 'CDATA comment' => array( '', WP_HTML_Processor::COMMENT_AS_CDATA_LOOKALIKE, ' cdata body ' ), - 'Processing instriction comment' => array( '', WP_HTML_Processor::COMMENT_AS_PI_NODE_LOOKALIKE, ' Instruction body. ', 'pi-target' ), - 'Processing instriction php' => array( '', WP_HTML_Processor::COMMENT_AS_PI_NODE_LOOKALIKE, ' const HTML_COMMENT = true; ', 'php' ), + 'Normative comment' => array( '', WP_HTML_Processor::COMMENT_AS_HTML_COMMENT, ' A comment. ' ), + 'Abruptly closed comment' => array( '', WP_HTML_Processor::COMMENT_AS_ABRUPTLY_CLOSED_COMMENT, '' ), + 'Invalid HTML comment !' => array( '', WP_HTML_Processor::COMMENT_AS_INVALID_HTML, ' Bang opener ' ), + 'Invalid HTML comment ?' => array( '', WP_HTML_Processor::COMMENT_AS_INVALID_HTML, ' Question opener ' ), + 'CDATA comment' => array( '', WP_HTML_Processor::COMMENT_AS_CDATA_LOOKALIKE, ' cdata body ' ), + 'Processing instruction xml' => array( '', WP_HTML_Processor::COMMENT_AS_PI_NODE_LOOKALIKE, ' version="1.0" ', 'xml' ), + 'Processing instruction xml-stylesheet' => array( '', WP_HTML_Processor::COMMENT_AS_PI_NODE_LOOKALIKE, ' href="a.css" ', 'xml-stylesheet' ), + 'Processing instruction XML-valid target' => array( '', WP_HTML_Processor::COMMENT_AS_PI_NODE_LOOKALIKE, ' const HTML_COMMENT = true; ', 'wp.bit' ), + 'Processing instruction bad target' => array( '', WP_HTML_Processor::COMMENT_AS_INVALID_HTML, '$var Not a target. ?' ), + 'PHP short echo tag' => array( '', WP_HTML_Processor::COMMENT_AS_INVALID_HTML, '= "Hello" ?' ), ); } diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessorModifiableText.php b/tests/phpunit/tests/html-api/wpHtmlProcessorModifiableText.php index 5d093ae05dd07..3072a46aa91d0 100644 --- a/tests/phpunit/tests/html-api/wpHtmlProcessorModifiableText.php +++ b/tests/phpunit/tests/html-api/wpHtmlProcessorModifiableText.php @@ -77,6 +77,8 @@ public static function data_modifiable_text_special_textarea(): array { * * @ticket 64751 * @dataProvider data_set_modifiable_fails_non_atomic_tags + * + * @expectedIncorrectUsage WP_HTML_Tag_Processor::set_modifiable_text */ public function test_set_modifiable_fails_non_atomic_tags( string $html, diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessorProcessingInstructions.php b/tests/phpunit/tests/html-api/wpHtmlProcessorProcessingInstructions.php new file mode 100644 index 0000000000000..d0d111cf913c6 --- /dev/null +++ b/tests/phpunit/tests/html-api/wpHtmlProcessorProcessingInstructions.php @@ -0,0 +1,226 @@ +next_token(); + + $this->assertSame( '#processing-instruction', $processor->get_token_name() ); + $this->assertSame( '#processing-instruction', $processor->get_token_type() ); + $this->assertSame( $expected_target, $processor->get_tag() ); + $this->assertSame( $expected_data, $processor->get_modifiable_text() ); + $this->assertNull( $processor->get_comment_type() ); + } + + /** + * Data provider. + * + * The whitespace following the target is not part of the data, but all + * further text through the closing `>` is, excepting a final `?` when + * the processing instruction is closed by `?>`. + * + * @return array + */ + public static function data_processing_instructions(): array { + return array( + 'Basic' => array( '', 'pi-target', 'Instruction body. ' ), + 'PHP block' => array( '', 'php', 'const HTML_COMMENT = true; ' ), + 'No data' => array( '', 'something', '' ), + 'No data, questionable close' => array( '', 'something', '' ), + 'Unclosed data' => array( '', 'something', 'good' ), + 'Data with spaces' => array( '', 'something', 'else is good' ), + 'Whitespace after target' => array( "", 'hey', 'there' ), + 'Tab terminates target' => array( "", 'hey', 'there=1' ), + 'Question mark in data' => array( '', 'hey', '?there' ), + 'Question mark data run' => array( '', 'something', '? ' ), + 'Data ending in question mark' => array( '', 'wp-bit', 'smile?' ), + 'Ends at first closer' => array( ' ?>', 't', 'd ' ), + 'Case preserved in target' => array( '', 'all-KINDS-of-CaSeS', 'data' ), + 'Underscore target' => array( '', '_x132', 'data' ), + 'Single-character target' => array( '', 'x', 'data' ), + 'Digits and hyphens in target' => array( '', 'r2-d2', 'data' ), + 'XML lookalike target prefix' => array( '', 'xml2', 'data' ), + 'IMAGE target not rewritten' => array( '', 'IMAGE', 'data' ), + ); + } + + /** + * Ensures that invalid or reserved processing instruction targets + * produce comments instead of processing instruction nodes. + * + * The comment cases are more fully covered in the comment processing tests. + * + * @ticket 61530 + * + * @dataProvider data_invalid_targets + * + * @param string $html Input whose processing-instruction-like syntax has an invalid target. + */ + public function test_invalid_targets_become_comments( string $html ): void { + $processor = WP_HTML_Processor::create_fragment( $html ); + $processor->next_token(); + + $this->assertSame( '#comment', $processor->get_token_name() ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_invalid_targets(): array { + return array( + 'Reserved xml target' => array( '' ), + 'Reserved xml-stylesheet target' => array( '' ), + 'Reserved target, cased' => array( '' ), + 'Leading digit' => array( '' ), + 'Leading hyphen' => array( '' ), + 'Colon in target' => array( '' ), + 'Dot in target' => array( '' ), + 'Non-ASCII target' => array( '' ), + 'Empty target' => array( '' ), + 'Whitespace target' => array( '' ), + 'PHP short echo tag' => array( '' ), + ); + } + + /** + * Ensures that a document ending inside a processing instruction + * pauses the processor at an incomplete token. + * + * @ticket 61530 + * + * @dataProvider data_incomplete_processing_instructions + * + * @param string $html Input ending inside a processing instruction. + */ + public function test_incomplete_processing_instruction( string $html ): void { + $processor = WP_HTML_Processor::create_full_parser( $html ); + + $this->assertFalse( $processor->next_token() ); + $this->assertTrue( $processor->paused_at_incomplete_token() ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_incomplete_processing_instructions(): array { + return array( + 'Bare opener' => array( ' array( ' array( ' array( ' array( ' array( ' ". + */ + public function test_processing_instruction_placement( string $html, string $breadcrumbs ): void { + $processor = WP_HTML_Processor::create_full_parser( $html ); + + while ( $processor->next_token() ) { + if ( '#processing-instruction' === $processor->get_token_type() ) { + $this->assertSame( + $breadcrumbs, + implode( ' > ', $processor->get_breadcrumbs() ), + 'Found the processing instruction in the wrong location.' + ); + return; + } + } + + $this->fail( 'Failed to find the processing instruction in the document.' ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_processing_instruction_placement(): array { + return array( + 'Before HTML' => array( '', '#processing-instruction' ), + 'In HEAD' => array( '', 'HTML > HEAD > #processing-instruction' ), + 'After HEAD' => array( '', 'HTML > #processing-instruction' ), + 'In BODY' => array( '', 'HTML > BODY > DIV > #processing-instruction' ), + 'In TABLE' => array( '', 'HTML > BODY > TABLE > #processing-instruction' ), + 'In TABLE ROW' => array( '', 'HTML > BODY > TABLE > TBODY > TR > #processing-instruction' ), + 'In TEMPLATE' => array( '', 'HTML > BODY > TEMPLATE > #processing-instruction' ), + 'In foreign content' => array( '', 'HTML > BODY > SVG > #processing-instruction' ), + ); + } + + /** + * Ensures that processing-instruction-like syntax inside raw text + * elements is not parsed as a processing instruction. + * + * @ticket 61530 + * + * @dataProvider data_raw_text_elements + * + * @param string $html Input containing processing-instruction-like syntax in a raw text element. + */ + public function test_no_processing_instruction_in_raw_text( string $html ): void { + $processor = WP_HTML_Processor::create_fragment( $html ); + + while ( $processor->next_token() ) { + $this->assertNotSame( + '#processing-instruction', + $processor->get_token_type(), + 'Should not have found a processing instruction inside a raw text element.' + ); + } + } + + /** + * Data provider. + * + * @return array + */ + public static function data_raw_text_elements(): array { + return array( + 'SCRIPT' => array( '' ), + 'STYLE' => array( '' ), + 'TEXTAREA' => array( '<?wp-bit?>' ), + 'TITLE' => array( '<?wp-bit?>' ), + ); + } +} diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRules.php b/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRules.php index ffc99ad58fd8e..da6d959eb75e0 100644 --- a/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRules.php +++ b/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRules.php @@ -163,7 +163,7 @@ public function test_in_body_button_with_no_button_in_scope() { } /** - * Verifies what when inserting a BUTTON element, when a BUTTON is already in scope, + * Verifies that when inserting a BUTTON element, when a BUTTON is already in scope, * that the open button is closed with all other elements inside of it. * * @ticket 58961 @@ -195,7 +195,7 @@ public function test_in_body_button_with_button_in_scope_as_parent() { } /** - * Verifies what when inserting a BUTTON element, when a BUTTON is already in scope, + * Verifies that when inserting a BUTTON element, when a BUTTON is already in scope, * that the open button is closed with all other elements inside of it, even if the * BUTTON in scope is not a direct parent of the new BUTTON element. * diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRulesListElements.php b/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRulesListElements.php index 0c7e3422f09fc..e89896da2298e 100644 --- a/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRulesListElements.php +++ b/tests/phpunit/tests/html-api/wpHtmlProcessorSemanticRulesListElements.php @@ -94,7 +94,7 @@ public function test_in_body_li_generates_implied_end_tags_inside_open_li_but_st $this->assertSame( array( 'HTML', 'BODY', 'LI', 'BLOCKQUOTE', 'LI' ), $processor->get_breadcrumbs(), - 'LI should have left the BLOCKQOUTE open, but closed it.' + 'LI should have left the BLOCKQUOTE open, but closed it.' ); } @@ -234,7 +234,7 @@ public function test_in_body_dd_generates_implied_end_tags_inside_open_dd_but_st $this->assertSame( array( 'HTML', 'BODY', 'DD', 'BLOCKQUOTE', 'DD' ), $processor->get_breadcrumbs(), - 'DD should have left the BLOCKQOUTE open, but closed it.' + 'DD should have left the BLOCKQUOTE open, but closed it.' ); } @@ -370,7 +370,7 @@ public function test_in_body_dt_generates_implied_end_tags_inside_open_dt_but_st $this->assertSame( array( 'HTML', 'BODY', 'DT', 'BLOCKQUOTE', 'DT' ), $processor->get_breadcrumbs(), - 'DT should have left the BLOCKQOUTE open, but closed it.' + 'DT should have left the BLOCKQUOTE open, but closed it.' ); } diff --git a/tests/phpunit/tests/html-api/wpHtmlProcessorHtml5lib.php b/tests/phpunit/tests/html-api/wpHtmlProcessorWebPlatformTests.php similarity index 84% rename from tests/phpunit/tests/html-api/wpHtmlProcessorHtml5lib.php rename to tests/phpunit/tests/html-api/wpHtmlProcessorWebPlatformTests.php index a03a9ab806a93..0cd53678858bd 100644 --- a/tests/phpunit/tests/html-api/wpHtmlProcessorHtml5lib.php +++ b/tests/phpunit/tests/html-api/wpHtmlProcessorWebPlatformTests.php @@ -6,11 +6,11 @@ * This test suite runs a set of tests on the HTML API using a third-party suite of test fixtures. * A third-party test suite allows the HTML API's behavior to be compared against an external * standard. Without a third-party, there is risk of oversight or misinterpretation of the standard - * being implemented in application code and in tests. html5lib-tests is used by other projects like - * browsers or other HTML parsers for the same purpose of validating behavior against an - * external reference. + * being implemented in application code and in tests. The Web Platform Tests tree-construction + * fixtures are used by other projects like browsers or other HTML parsers for the same purpose + * of validating behavior against an external reference. * - * See the README file at DIR_TESTDATA / html5lib-tests for details on the third-party suite. + * See the README file at DIR_TESTDATA / web-platform-tests for details on the third-party suite. * * @package WordPress * @subpackage HTML-API @@ -18,9 +18,9 @@ * @since 6.6.0 * * @group html-api - * @group html-api-html5lib-tests + * @group html-api-web-platform-tests */ -class Tests_HtmlApi_Html5lib extends WP_UnitTestCase { +class Tests_HtmlApi_WebPlatformTests extends WP_UnitTestCase { const TREE_INDENT = ' '; /** @@ -38,15 +38,18 @@ class Tests_HtmlApi_Html5lib extends WP_UnitTestCase { 'tests2/line0697' => 'Unimplemented: This parser does not add missing attributes to existing HTML or BODY tags.', 'tests2/line0709' => 'Unimplemented: This parser does not add missing attributes to existing HTML or BODY tags.', 'webkit01/line0231' => 'Unimplemented: This parser does not add missing attributes to existing HTML or BODY tags.', + 'webkit02/line0692' => 'Unimplemented: The parser does not implement the "maybe clone an option into selectedcontent" algorithm.', + 'webkit02/line0732' => 'Unimplemented: The parser does not implement the "maybe clone an option into selectedcontent" algorithm.', + 'webkit02/line0748' => 'Unimplemented: The parser does not implement the "maybe clone an option into selectedcontent" algorithm.', ); /** * Verify the parsing results of the HTML Processor against the - * test cases in the Html5lib tests project. + * test cases in the Web Platform Tests tree-construction suite. * * @ticket 60227 * - * @dataProvider data_external_html5lib_tests + * @dataProvider data_external_web_platform_tests * * @param string|null $fragment_context Context element in which to parse HTML, such as BODY or SVG. * @param string $html Given test HTML. @@ -98,12 +101,12 @@ public function test_parse( ?string $fragment_context, string $html, string $exp /** * Data provider. * - * Tests from https://github.com/html5lib/html5lib-tests + * Tests from https://github.com/web-platform-tests/wpt/tree/master/html/syntax/parsing/resources * * @return array[] */ - public function data_external_html5lib_tests() { - $test_dir = DIR_TESTDATA . '/html5lib-tests/tree-construction/'; + public function data_external_web_platform_tests() { + $test_dir = DIR_TESTDATA . '/web-platform-tests/html_syntax_parsing_resources/'; $handle = opendir( $test_dir ); while ( false !== ( $entry = readdir( $handle ) ) ) { @@ -111,7 +114,7 @@ public function data_external_html5lib_tests() { continue; } - foreach ( self::parse_html5_dat_testfile( $test_dir . $entry ) as $k => $test ) { + foreach ( self::parse_web_platform_test_file( $test_dir . $entry ) as $k => $test ) { // strip .dat extension from filename $test_suite = substr( $entry, 0, -4 ); $line = str_pad( strval( $test[0] ), 4, '0', STR_PAD_LEFT ); @@ -132,8 +135,8 @@ public function data_external_html5lib_tests() { /** * Determines whether a test case should be skipped. * - * @param string $test_name Test name. - * @param string $expected_tree Expected HTML tree structure. + * @param string|null $test_context_element Context element for fragment parsing, or null for full document parsing. + * @param string $test_name Test name. * * @return bool True if the test case should be skipped. False otherwise. */ @@ -150,7 +153,7 @@ private static function should_skip_test( ?string $test_context_element, string } /** - * Generates the tree-like structure represented in the Html5lib tests. + * Generates the tree-like structure represented in the Web Platform Tests fixtures. * * @param string|null $fragment_context Context element in which to parse HTML, such as BODY or SVG. * @param string $html Given test HTML. @@ -228,7 +231,7 @@ private static function build_tree_representation( ?string $fragment_context, st } /* - * Sorts attributes to match html5lib sort order. + * Sorts attributes to match Web Platform Tests tree-construction order. * * - First comes normal HTML attributes. * - Then come adjusted foreign attributes; these have spaces in their names. @@ -306,6 +309,15 @@ static function ( $a, $b ) { $output .= str_repeat( self::TREE_INDENT, $indent_level ) . "\n"; break; + case '#processing-instruction': + /* + * Processing instructions must be "". + */ + $pi_data = $processor->get_modifiable_text(); + $output .= str_repeat( self::TREE_INDENT, $indent_level ) . "get_tag()} {$pi_data}?>\n"; + break; + case '#comment': // Comments must be "<" then "!-- " then the data then " -->". $output .= str_repeat( self::TREE_INDENT, $indent_level ) . "\n"; @@ -338,14 +350,18 @@ static function ( $a, $b ) { } /** - * Convert a given Html5lib test file into a test triplet. + * Convert a given Web Platform Tests fixture file into a series of test cases. * * @param string $filename Path to `.dat` file with test cases. * - * @return array|Generator Test triplets of HTML fragment context element, - * HTML, and the DOM structure it represents. + * @return Generator Test cases. */ - public static function parse_html5_dat_testfile( $filename ) { + public static function parse_web_platform_test_file( $filename ) { $handle = fopen( $filename, 'r', false ); /** @@ -432,14 +448,6 @@ public static function parse_html5_dat_testfile( $filename ) { * the tree of the parsed DOM. Each node must be represented by a single line. Each line * must start with "| ", followed by two spaces per parent node that the node has before * the root document node. - * - * - Element nodes must be represented by a "<" then the tag name string ">", and all the attributes must be given, sorted lexicographically by UTF-16 code unit according to their attribute name string, on subsequent lines, as if they were children of the element node. - * - Attribute nodes must have the attribute name string, then an "=" sign, then the attribute value in double quotes ("). - * - Text nodes must be the string, in double quotes. Newlines aren't escaped. - * - Comments must be "<" then "!-- " then the data then " -->". - * - DOCTYPEs must be "". - * - Processing instructions must be "". (The HTML parser cannot emit processing instructions, but scripts can, and the WebVTT to DOM rules can emit them.) - * - Template contents are represented by the string "content" with the children below it. */ case 'document': if ( '|' === $line[0] ) { @@ -455,13 +463,20 @@ public static function parse_html5_dat_testfile( $filename ) { fclose( $handle ); - // Return the last result when reaching the end of the file. - return array( - $test_line_number, - $test_context_element, - // Remove the trailing newline - substr( $test_html, 0, -1 ), - $test_dom, - ); + // Yield the last result when reaching the end of the file. + if ( $state && ! $test_script_flag ) { + // Other tests include the blank line separating them from the next test. + if ( ! str_ends_with( $test_dom, "\n\n" ) ) { + $test_dom .= "\n"; + } + + yield array( + $test_line_number, + $test_context_element, + // Remove the trailing newline + substr( $test_html, 0, -1 ), + $test_dom, + ); + } } } diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessor-bookmark.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessor-bookmark.php index 0e72f9d726835..beb4cc60f6d95 100644 --- a/tests/phpunit/tests/html-api/wpHtmlTagProcessor-bookmark.php +++ b/tests/phpunit/tests/html-api/wpHtmlTagProcessor-bookmark.php @@ -518,7 +518,7 @@ public function test_can_seek_after_document_ends( $html_with_target_element ) { */ public static function data_incomplete_html_with_target_nodes_for_seeking() { return array( - 'Compete document' => array( '' ), + 'Complete document' => array( '' ), 'Incomplete document' => array( 'assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertSame( $expected, $processor->get_attribute( 'a' ) ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_attribute_values_with_preprocessing(): array { + return array( + 'Raw CR' => array( "", "x\ny" ), + 'Raw CRLF' => array( "", "x\ny" ), + 'Raw CR then CRLF' => array( "", "x\n\ny" ), + 'Double-quoted raw CR' => array( "", "x\ny" ), + 'NULL byte' => array( "", "x\u{FFFD}y" ), + 'NULL byte unquoted' => array( "", "x\u{FFFD}y" ), + 'Encoded CR is preserved' => array( "", "x\ry" ), + 'Encoded NULL becomes U+FFFD' => array( "", "x\u{FFFD}y" ), + 'Raw CR before encoded CR' => array( "", "x\n\ry" ), + 'Raw CR and NULL byte' => array( "", "x\n\u{FFFD}y" ), + 'Named reference before NULL' => array( "", "x&\u{FFFD};y" ), + 'Named reference before CR' => array( "", "x&\ny" ), + ); + } + + /** + * Ensures that values enqueued through `set_attribute()` are returned verbatim. + * + * Input-stream preprocessing applies only to the input document. API-supplied + * values are plaintext, equivalent to DOM `setAttribute()`, which performs + * no replacements. Browser-verified. + * + * @ticket 65372 + * + * @covers ::get_attribute + * + * @dataProvider data_enqueued_attribute_values + * + * @param string $value Plaintext attribute value to set and expect back unchanged. + */ + public function test_get_attribute_returns_enqueued_values_verbatim( string $value ): void { + $processor = new WP_HTML_Tag_Processor( '' ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertTrue( $processor->set_attribute( 'a', $value ), 'Should have enqueued the attribute update.' ); + $this->assertSame( $value, $processor->get_attribute( 'a' ) ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_enqueued_attribute_values(): array { + return array( + 'Carriage return' => array( "x\ry" ), + 'CRLF' => array( "x\r\ny" ), + 'NULL byte' => array( "x\x00y" ), + ); + } + + /** + * Ensures the existing class attribute value is preprocessed when enqueued + * class updates are flushed into an attribute update. + * + * @ticket 65372 + * + * @covers ::add_class + * + * @dataProvider data_class_updates_with_preprocessing + * + * @param string $html HTML containing a tag with a class attribute. + * @param string $expected_html Expected document after adding a class. + */ + public function test_class_updates_apply_input_preprocessing_to_existing_value( string $html, string $expected_html ): void { + $processor = new WP_HTML_Tag_Processor( $html ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertTrue( $processor->add_class( 'added' ), 'Should have enqueued the class addition.' ); + $this->assertSame( $expected_html, $processor->get_updated_html() ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_class_updates_with_preprocessing(): array { + return array( + 'Raw CR' => array( "", "" ), + 'Raw CRLF' => array( "", "" ), + 'NULL byte' => array( "", "" ), + 'Named reference before NULL' => array( "", "" ), + ); + } + + /** + * Ensures attribute names containing NULL bytes are exposed with U+FFFD and + * are addressable only by their replaced name, as browsers expose them. + * + * Browser-verified: `getAttribute("da\u{FFFD}ta")` finds the attribute + * parsed from `da\x00ta`; `getAttribute("da\x00ta")` does not. + * + * @ticket 65372 + * + * @covers ::get_attribute + * @covers ::get_attribute_names_with_prefix + */ + public function test_attribute_names_replace_null_bytes(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertSame( array( "da\u{FFFD}ta" ), $processor->get_attribute_names_with_prefix( '' ) ); + $this->assertSame( '1', $processor->get_attribute( "da\u{FFFD}ta" ), 'Should have found the attribute by its replaced name.' ); + $this->assertNull( $processor->get_attribute( "da\x00ta" ), 'Should not have found the attribute by its raw source name.' ); + + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertSame( array( "da\u{FFFD}ta" ), $processor->get_attribute_names_with_prefix( '' ), 'Should have lowercased the name around the replacement character.' ); + } + + /** + * Ensures attribute names which collapse to the same name after NULL-byte + * replacement are duplicates of one attribute: the first in document order + * provides the value and removal removes every collapsed copy. + * + * Browser-verified: `` produces a single + * attribute `da\u{FFFD}ta` with value "1". + * + * @ticket 65372 + * + * @covers ::get_attribute + * @covers ::remove_attribute + */ + public function test_attribute_names_collapsing_after_null_replacement_are_duplicates(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertSame( array( "da\u{FFFD}ta" ), $processor->get_attribute_names_with_prefix( '' ) ); + $this->assertSame( '1', $processor->get_attribute( "da\u{FFFD}ta" ), 'First duplicate should provide the value.' ); + + $this->assertTrue( $processor->remove_attribute( "da\u{FFFD}ta" ), 'Should have removed the attribute.' ); + $this->assertSame( '', $processor->get_updated_html(), 'Should have removed all duplicates of the attribute.' ); + } + + /** + * Ensures setting an attribute by its U+FFFD-replaced name updates the + * source attribute whose raw name contains a NULL byte instead of adding + * a second attribute. + * + * @ticket 65372 + * + * @covers ::set_attribute + */ + public function test_set_attribute_updates_attribute_with_null_byte_in_source_name(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertTrue( $processor->set_attribute( "da\u{FFFD}ta", 'new' ), 'Should have set the attribute.' ); + $this->assertSame( "", $processor->get_updated_html() ); + } + + /** + * Ensures tag names containing NULL bytes are exposed with U+FFFD, + * matching the tokenizer's tag-name-state replacement in browsers. + * + * @ticket 65372 + * + * @covers ::get_tag + * @covers ::get_token_name + */ + public function test_get_tag_replaces_null_bytes(): void { + $processor = new WP_HTML_Tag_Processor( "x" ); + + $this->assertTrue( $processor->next_token(), 'Should have found the tag opener.' ); + $this->assertSame( "DI\u{FFFD}V", $processor->get_tag() ); + $this->assertSame( "DI\u{FFFD}V", $processor->get_token_name() ); + + $this->assertTrue( $processor->next_token(), 'Should have found the text node.' ); + $this->assertSame( 'x', $processor->get_modifiable_text() ); + + $this->assertTrue( $processor->next_token(), 'Should have found the tag closer.' ); + $this->assertTrue( $processor->is_tag_closer(), 'Should have matched the tag closer.' ); + $this->assertSame( "DI\u{FFFD}V", $processor->get_tag() ); + } + + /** + * Ensures NULL bytes in tag names do not affect special-element detection: + * `` is not SCRIPT and does not switch into rawtext parsing, + * in browsers or here. Internal identification uses raw bytes. + * + * @ticket 65372 + * + * @covers ::get_tag + */ + public function test_null_byte_in_tag_name_does_not_select_rawtext_parsing(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_token(), 'Should have found the tag opener.' ); + $this->assertSame( "SCR\u{FFFD}IPT", $processor->get_tag() ); + + $this->assertTrue( $processor->next_token(), 'Should have found the B tag, not raw text.' ); + $this->assertSame( 'B', $processor->get_tag() ); + } + + /** + * Ensures NULL bytes cannot appear in PI-lookalike comment tag names, + * whose targets are restricted to ASCII name characters. + * + * @ticket 65372 + * + * @covers ::get_tag + */ + public function test_pi_lookalike_target_stops_before_null_byte(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_token(), 'Should have found the comment.' ); + $this->assertSame( WP_HTML_Tag_Processor::COMMENT_AS_PI_NODE_LOOKALIKE, $processor->get_comment_type() ); + $this->assertSame( 'px', $processor->get_tag() ); + } + + /** + * Ensures tag-name queries match in the same replaced alphabet that + * `get_tag()` exposes: a sought name containing U+FFFD matches source + * names whose raw bytes contain NULL in its place, a sought name + * containing a raw NULL byte matches nothing, and the value returned + * by `get_tag()` round-trips into a successful query. + * + * This is also how WP_HTML_Processor::next_tag() matches, since it + * compares sought names against the token name. + * + * @ticket 65372 + * + * @covers ::next_tag + */ + public function test_tag_name_queries_match_replaced_names(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + $this->assertTrue( $processor->next_tag( "DI\u{FFFD}V" ), 'Should have matched the tag by its replaced name.' ); + + $processor = new WP_HTML_Tag_Processor( "" ); + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $tag_name = $processor->get_tag(); + $processor = new WP_HTML_Tag_Processor( "" ); + $this->assertTrue( $processor->next_tag( array( 'tag_name' => $tag_name ) ), 'The name returned by get_tag() should match in a query.' ); + + $processor = new WP_HTML_Tag_Processor( "" ); + $this->assertFalse( $processor->next_tag( "DI\x00V" ), 'Should not have matched the tag by its raw source name.' ); + + $processor = new WP_HTML_Tag_Processor( "" ); + $this->assertTrue( $processor->next_tag( "DI\u{FFFD}V" ), 'Should have matched a raw U+FFFD name.' ); + + $processor = WP_HTML_Processor::create_full_parser( "" ); + $this->assertTrue( $processor->next_tag( array( 'tag_name' => "DI\u{FFFD}V" ) ), 'The HTML Processor should match the replaced name.' ); + + $processor = WP_HTML_Processor::create_full_parser( "" ); + $this->assertFalse( $processor->next_tag( array( 'tag_name' => "DI\x00V" ) ), 'The HTML Processor should not match the raw source name.' ); + } + + /** + * Ensures class_list does not replace NULL bytes in API-supplied values. + * + * Browser-verified: `setAttribute('class', "a\x00b")` then reading + * `classList` yields the token "a\x00b" with the NULL byte preserved; + * U+0000 replacement happens only in the tokenizer, and values from the + * input document already receive it through `get_attribute()`. + * + * @ticket 65372 + * + * @covers ::class_list + * @covers ::has_class + */ + public function test_class_list_preserves_null_bytes_in_enqueued_values(): void { + $processor = new WP_HTML_Tag_Processor( '' ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertTrue( $processor->set_attribute( 'class', "a\x00b c\u{FFFD}d" ), 'Should have set the class attribute.' ); + $this->assertSame( array( "a\x00b", "c\u{FFFD}d" ), iterator_to_array( $processor->class_list(), false ), 'Should have preserved the NULL byte in the API-supplied class.' ); + $this->assertTrue( $processor->has_class( "a\x00b" ) ); + } + + /** + * Ensures the class helpers operate on the replaced source value: + * a class containing a NULL byte in the document is exposed, matched, + * and queried by its U+FFFD spelling only. + * + * @ticket 65372 + * + * @covers ::class_list + * @covers ::has_class + * @covers ::next_tag + */ + public function test_class_helpers_use_replaced_source_values(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertSame( array( "a\u{FFFD}b" ), iterator_to_array( $processor->class_list(), false ), 'Should have exposed the replaced class name.' ); + $this->assertTrue( $processor->has_class( "a\u{FFFD}b" ), 'Should have matched the replaced class name.' ); + $this->assertFalse( $processor->has_class( "a\x00b" ), 'Should not have matched the raw source class name.' ); + + $processor = new WP_HTML_Tag_Processor( "" ); + $this->assertTrue( $processor->next_tag( array( 'class_name' => "a\u{FFFD}b" ) ), 'Should have matched a class_name query by the replaced name.' ); + } + + /** + * Ensures boolean attributes whose names contain NULL bytes are + * addressable by their replaced name. + * + * @ticket 65372 + * + * @covers ::get_attribute + */ + public function test_boolean_attribute_with_null_byte_in_name(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertTrue( $processor->get_attribute( "da\u{FFFD}ta" ), 'Should have reported the boolean attribute by its replaced name.' ); + } + + /** + * Ensures attribute-name prefixes are matched verbatim against the + * replaced names: a prefix spelled with U+FFFD matches, and a prefix + * containing a raw NULL byte matches nothing. + * + * @ticket 65372 + * + * @covers ::get_attribute_names_with_prefix + */ + public function test_attribute_name_prefixes_match_replaced_names(): void { + $processor = new WP_HTML_Tag_Processor( "" ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertSame( array( "da\u{FFFD}ta" ), $processor->get_attribute_names_with_prefix( "da\u{FFFD}" ), 'A replaced-name prefix should match.' ); + $this->assertSame( array(), $processor->get_attribute_names_with_prefix( "da\x00" ), 'A raw NULL prefix should match nothing.' ); + } + + /** + * Ensures the replaced tag names flow through HTML Processor tree + * construction: an end tag spelled with U+FFFD closes an element + * whose start tag was spelled with a raw NULL byte, as in browsers, + * where both spellings tokenize to the same name. + * + * @ticket 65372 + */ + public function test_html_processor_matches_end_tags_across_null_byte_spellings(): void { + $this->assertSame( + "xy", + WP_HTML_Processor::normalize( "xy" ), + 'The U+FFFD-spelled end tag should have closed the NULL-spelled element.' + ); + + $processor = WP_HTML_Processor::create_full_parser( "xy" ); + $this->assertTrue( $processor->next_tag( array( 'tag_name' => "DI\u{FFFD}V" ) ), 'Should have found the element by its replaced name.' ); + $this->assertSame( array( 'HTML', 'BODY', "DI\u{FFFD}V" ), $processor->get_breadcrumbs(), 'Should have built breadcrumbs from replaced names.' ); + } + + /** + * Ensures pending class updates are flushed for any case spelling of + * the "class" attribute name, since attribute names are matched + * ASCII-case-insensitively. + * + * @ticket 65372 + * + * @covers ::get_attribute + */ + public function test_get_attribute_flushes_class_updates_case_insensitively(): void { + $processor = new WP_HTML_Tag_Processor( '' ); + + $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' ); + $this->assertTrue( $processor->add_class( 'b' ), 'Should have enqueued the class addition.' ); + $this->assertSame( 'a b', $processor->get_attribute( 'CLASS' ), 'Should have included pending class updates for an uppercase lookup.' ); + } + + /** + * Ensures numeric character references for U+0000 decode to U+FFFD in text. + * + * @ticket 65372 + * + * @covers ::get_modifiable_text + */ + public function test_encoded_null_in_text_node_decodes_to_replacement_character(): void { + $processor = new WP_HTML_Tag_Processor( 'a�b' ); + + $this->assertTrue( $processor->next_token(), 'Should have found the text node.' ); + $this->assertSame( "a\u{FFFD}b", $processor->get_modifiable_text() ); + } +} diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessor-token-scanning.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessor-token-scanning.php index e8195dcfa28c6..e6c77024848dd 100644 --- a/tests/phpunit/tests/html-api/wpHtmlTagProcessor-token-scanning.php +++ b/tests/phpunit/tests/html-api/wpHtmlTagProcessor-token-scanning.php @@ -579,6 +579,7 @@ public function test_empty_cdata_in_foreign_content() { * @ticket 60170 * * @since 6.5.0 + * @since 7.1.0 Processing instructions produce their own token type. * * @covers WP_HTML_Tag_Processor::next_token */ @@ -586,6 +587,49 @@ public function test_basic_assertion_processing_instruction() { $processor = new WP_HTML_Tag_Processor( '' ); $processor->next_token(); + $this->assertSame( + '#processing-instruction', + $processor->get_token_name(), + "Should have found processing instruction token but found {$processor->get_token_name()} instead." + ); + + $this->assertNull( + $processor->get_comment_type(), + 'Should not have detected a comment type on a non-comment token.' + ); + + $this->assertSame( + 'wp-bit', + $processor->get_tag(), + "Should have found PI target as tag name but found {$processor->get_tag()} instead." + ); + + $this->assertNull( + $processor->get_attribute( 'type' ), + 'Should not have been able to query attributes on non-element token.' + ); + + $this->assertSame( + '{"just": "kidding"}', + $processor->get_modifiable_text(), + 'Found incorrect modifiable text.' + ); + } + + /** + * Ensures that Processing Instruction nodes with reserved XML targets + * are properly parsed as bogus comments. + * + * @ticket 60170 + * + * @since 7.1.0 + * + * @covers WP_HTML_Tag_Processor::next_token + */ + public function test_basic_assertion_xml_processing_instruction(): void { + $processor = new WP_HTML_Tag_Processor( '' ); + $processor->next_token(); + $this->assertSame( '#comment', $processor->get_token_name(), @@ -599,21 +643,27 @@ public function test_basic_assertion_processing_instruction() { ); $this->assertSame( - 'wp-bit', + 'xml', $processor->get_tag(), "Should have found PI target as tag name but found {$processor->get_tag()} instead." ); $this->assertNull( - $processor->get_attribute( 'type' ), + $processor->get_attribute( 'version' ), 'Should not have been able to query attributes on non-element token.' ); $this->assertSame( - ' {"just": "kidding"}', + ' version="1.0"', $processor->get_modifiable_text(), 'Found incorrect modifiable text.' ); + + $this->assertSame( + '?xml version="1.0"?', + $processor->get_full_comment_text(), + 'Found incorrect full comment text.' + ); } /** @@ -951,6 +1001,48 @@ public static function data_various_funky_comments() { ); } + /** + * Ensures that incomplete tokens fail closed without reading beyond the input. + * + * @ticket 65372 + * + * @dataProvider data_incomplete_tokens_from_fuzzer + * + * @param string $html Incomplete HTML input. + */ + public function test_incomplete_tokens_do_not_emit_native_errors( string $html ) { + $errors = array(); + set_error_handler( + static function ( int $errno, string $errstr ) use ( &$errors ) { + $errors[] = "{$errno}: {$errstr}"; + return true; + } + ); + + try { + $processor = new WP_HTML_Tag_Processor( $html ); + $found = $processor->next_token(); + } finally { + restore_error_handler(); + } + + // Use assertSame() instead of assertEmpty() so PHPUnit shows captured error messages on failure. + $this->assertSame( array(), $errors ); + $this->assertFalse( $found, 'Should not have found a complete token.' ); + } + + /** + * Data provider. + * + * @return array[] + */ + public static function data_incomplete_tokens_from_fuzzer() { + return array( + 'Incomplete short comment' => array( '', 1, '' ), 'Empty comment' => array( '', 1, '' ), 'Funky comment' => array( '', 1, '' ), - 'PI lookalike comment' => array( '', 1, '' ), + 'Processing instruction' => array( '', 1, '' ), + 'PI lookalike comment' => array( '', 1, '' ), 'CDATA lookalike comment' => array( '', 1, '' ), ); } @@ -886,11 +891,12 @@ public function test_attribute_ops_on_tag_closer_do_not_change_the_markup() { * $processor = new WP_HTML_Tag_Processor( '' ); * $processor->next_tag(); * $processor->set_attribute('class', '" onclick="alert'); - * echo $p; + * echo $processor->get_updated_html(); * // * ``` * - * To prevent it, `set_attribute` calls `esc_attr()` on its given values. + * To prevent it, `set_attribute` escapes HTML syntax characters like `"` using + * HTML character references. * * ```php * @@ -1523,11 +1529,11 @@ public function test_calling_remove_class_with_all_listed_class_names_removes_th $this->assertSame( 'Text', $processor->get_updated_html(), - 'Updated HTML does not reflect class attribute removed via subesequent remove_class() calls' + 'Updated HTML does not reflect class attribute removed via subsequent remove_class() calls' ); $this->assertNull( $processor->get_attribute( 'class' ), - "get_attribute( 'class' ) did not return null for class attribute removed via subesequent remove_class() calls" + "get_attribute( 'class' ) did not return null for class attribute removed via subsequent remove_class() calls" ); } @@ -2116,6 +2122,8 @@ public static function data_script_tag(): Generator { yield 'Script tag with close' => array( "', true ); + yield 'Script text less-than' => array( '', true ); + yield 'Script text less-than solidus' => array( '', true ); yield 'Script data escaped' => array( '', true ); yield 'Script data double-escaped exit (comment)' => array( '', true ); yield 'Script data double-escaped exit (closed ">")' => array( '', true ); diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php index f43d1fffaad0e..589318daf3a70 100644 --- a/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php +++ b/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php @@ -349,6 +349,8 @@ public function test_get_modifiable_text_ignores_newlines_after_seeking() { * * @dataProvider data_tokens_not_supporting_modifiable_text_updates * + * @expectedIncorrectUsage WP_HTML_Tag_Processor::set_modifiable_text + * * @param string $html Contains HTML with a token not supporting modifiable text updates. * @param int $advance_n_tokens Count of times to run `next_token()` before reaching target node. */ @@ -415,7 +417,7 @@ public function test_updates_basic_modifiable_text_on_supported_nodes( string $h $this->assertSame( $transformed, $processor->get_updated_html(), - "Should have transformed the HTML as expected why modifying the target node's modifiable text." + "Should have transformed the HTML as expected when modifying the target node's modifiable text." ); } @@ -428,8 +430,14 @@ public static function data_tokens_with_basic_modifiable_text_updates() { return array( 'Text node (start)' => array( 'Text', 1, 'Blubber', 'Blubber' ), 'Text node (middle)' => array( 'Bold move', 2, 'yo', 'yo' ), + 'PI node' => array( 'beforeafter', 2, 'other', 'beforeafter' ), + 'PI node (no separator)' => array( '', 1, '{"just": "kidding"}', '' ), 'Text node (end)' => array( 'of a dog', 2, 'of a cat', 'of a cat' ), 'Encoded text node' => array( 'birds and dogs', 2, ' & ', '<birds> & <dogs>' ), + 'IFRAME tag' => array( 'beforeold contentafter', 2, 'raw & text', 'before<p>raw & text</p>after' ), + 'NOEMBED tag' => array( 'beforeold contentafter', 2, 'raw & text', 'before<p>raw & text</p>after' ), + 'NOFRAMES tag' => array( 'beforeold contentafter', 2, 'raw & text', 'before<p>raw & text</p>after' ), + 'XMP tag' => array( 'beforeold contentafter', 2, 'raw & text', 'before<p>raw & text</p>after' ), 'SCRIPT tag' => array( 'beforeafter', 2, 'const img = " & ";', 'beforeafter' ), 'STYLE tag' => array( '', 1, 'p::before { content: " & "; }', '' ), 'TEXTAREA tag' => array( 'ahas no need to escapeb', 2, "so it ", "aso it <doesn't>b" ), @@ -441,6 +449,134 @@ public static function data_tokens_with_basic_modifiable_text_updates() { ); } + /** + * Ensures that processing instruction data updates re-parse to the value which was set. + * + * The processing instruction syntax cannot represent every data value verbatim: + * a separating space must be added when the data would abut the target, and + * the update always writes the `?>` form of the closer, whose `?` is dropped + * when parsing, so that data ending in `?` remains intact. + * + * @ticket 61530 + * + * @dataProvider data_processing_instruction_data_updates + * + * @param string $html Contains a processing instruction as its first token. + * @param string $new_data Data to set on the processing instruction. + * @param string $expected Expected document after the update. + */ + public function test_sets_processing_instruction_data( string $html, string $new_data, string $expected ): void { + $processor = new WP_HTML_Tag_Processor( $html ); + $processor->next_token(); + + $this->assertSame( + '#processing-instruction', + $processor->get_token_name(), + 'Should have found a processing instruction: check test setup.' + ); + + $target = $processor->get_tag(); + + $this->assertTrue( + $processor->set_modifiable_text( $new_data ), + 'Should have set the processing instruction data.' + ); + + $this->assertSame( + $new_data, + $processor->get_modifiable_text(), + 'Should have read back the enqueued data before flushing the update.' + ); + + $this->assertSame( + $expected, + $processor->get_updated_html(), + 'Should have updated the document as expected.' + ); + + $this->assertSame( + $new_data, + $processor->get_modifiable_text(), + 'Should have read back the data after flushing the update.' + ); + + $this->assertSame( + $target, + $processor->get_tag(), + 'Should not have changed the processing instruction target.' + ); + + $reparsed = new WP_HTML_Tag_Processor( $expected ); + $reparsed->next_token(); + + $this->assertSame( + '#processing-instruction', + $reparsed->get_token_name(), + 'Should have found a processing instruction when re-parsing the updated document.' + ); + + $this->assertSame( + $target, + $reparsed->get_tag(), + 'Should have preserved the target when re-parsing the updated document.' + ); + + $this->assertSame( + $new_data, + $reparsed->get_modifiable_text(), + 'Should have found the set data when re-parsing the updated document.' + ); + } + + /** + * Data provider. + * + * @return array + */ + public static function data_processing_instruction_data_updates(): array { + return array( + 'Replace data' => array( '', 'after', '' ), + 'Bare closer rewritten' => array( '', 'after', '' ), + 'Separator inserted' => array( '', '{"just": "kidding"}', '' ), + 'Separator inserted (bare closer)' => array( '', 'data', '' ), + 'Data abutting target' => array( '', 'x', '' ), + 'Data ending in ?' => array( '', 'd?', '' ), + 'Data ending in ? (?> closer)' => array( '', 'd?', '' ), + 'Data of only ?' => array( '', '?', '' ), + 'Emptied (?> closer)' => array( '', '', '' ), + 'Emptied (bare closer)' => array( '', '', '' ), + 'Empty data set on empty data' => array( '', '', '' ), + 'Whitespace run normalized' => array( "", 'new', '' ), + ); + } + + /** + * Ensures that repeated processing instruction data updates replace + * each other instead of accumulating syntax adjustments. + * + * @ticket 61530 + */ + public function test_replaces_previous_processing_instruction_data_update(): void { + $processor = new WP_HTML_Tag_Processor( '' ); + $processor->next_token(); + + $this->assertTrue( + $processor->set_modifiable_text( 'first?' ), + 'Should have set the initial processing instruction data.' + ); + + $this->assertTrue( + $processor->set_modifiable_text( 'second' ), + 'Should have replaced the pending processing instruction data.' + ); + + $this->assertSame( + '', + $processor->get_updated_html(), + 'Should have applied only the last update to the document.' + ); + } + /** * Ensures that updates with potentially-compromising values aren't accepted. * @@ -453,6 +589,8 @@ public static function data_tokens_with_basic_modifiable_text_updates() { * * @dataProvider data_unallowed_modifiable_text_updates * + * @expectedIncorrectUsage WP_HTML_Tag_Processor::set_modifiable_text + * * @param string $html_with_nonempty_modifiable_text Will be used to find the test element. * @param string $invalid_update Update containing possibly-compromising text. */ @@ -490,6 +628,14 @@ public static function data_unallowed_modifiable_text_updates() { return array( 'Comment with -->' => array( '', 'Comments end in -->' ), 'Comment with --!>' => array( '', 'Invalid but legitimate comments end in --!>' ), + 'IFRAME with ' => array( 'Replace me', 'Just a ' ), + 'NOEMBED with ' => array( 'Replace me', 'Just a ' ), + 'NOFRAMES with ' => array( 'Replace me', 'beforeafter' ), + 'XMP with ' => array( 'Replace me', 'Just a ' ), + 'PI with >' => array( '', 'Processing instructions end at the first >' ), + 'PI with leading space' => array( '', ' leading whitespace is skipped after the target' ), + 'PI with leading tab' => array( '', "\tleading whitespace is skipped after the target" ), + 'PI with only whitespace' => array( '', ' ' ), 'Non-JS SCRIPT with ', '
", "
\nline 1\nline 2
line 1\nline 2
\n\nline 2\nline 3
\nline 1 still line 1
line 1 still line 1
\n\nline 2 still line 2
raw & text