diff --git a/tests/phpunit/tests/oembed/filterResult.php b/tests/phpunit/tests/oembed/filterResult.php index d2c1c8614115a..10dbe0e4ea017 100644 --- a/tests/phpunit/tests/oembed/filterResult.php +++ b/tests/phpunit/tests/oembed/filterResult.php @@ -9,26 +9,57 @@ public function test_filter_oembed_result_trusted_malicious_iframe() { $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), 'https://www.youtube.com/watch?v=72xdCU__XCk' ); - $this->assertSame( $html, $actual ); + $this->assertEqualHTML( $html, $actual ); } public function test_filter_oembed_result_with_untrusted_provider() { $html = '
'; $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), 'http://example.com/sample-page/' ); - $matches = array(); - preg_match( '|src=".*#\?secret=([\w\d]+)" data-secret="([\w\d]+)"|', $actual, $matches ); + $processor = new WP_HTML_Tag_Processor( $actual ); - $this->assertArrayHasKey( 1, $matches ); - $this->assertArrayHasKey( 2, $matches ); - $this->assertSame( $matches[1], $matches[2] ); + $this->assertTrue( + $processor->next_tag( 'IFRAME' ), + 'Failed to find expected IFRAME element in filtered output.' + ); + + $src = $processor->get_attribute( 'src' ); + $this->assertIsString( + $src, + isset( $src ) + ? 'Expected "src" attribute on IFRAME with string value but found boolean attribute instead.' + : 'Failed to find expected "src" attribute on IFRAME element.' + ); + + $query_string = parse_url( $src, PHP_URL_FRAGMENT ); + $this->assertStringStartsWith( + '?', + $query_string, + 'Should have found URL fragment in "src" attribute resembling a query string.' + ); + + $query_string = substr( $query_string, 1 ); + $query_args = array(); + parse_str( $query_string, $query_args ); + + $this->assertArrayHasKey( + 'secret', + $query_args, + 'Failed to find expected query arg "secret" in IFRAME "src" attribute.' + ); + + $this->assertSame( + $query_args['secret'], + $processor->get_attribute( 'data-secret' ), + 'Expected to find identical copy of secret from IFRAME "src" in the "data-secret" attribute.' + ); } public function test_filter_oembed_result_only_one_iframe_is_allowed() { $html = ''; $actual = wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' ); - $this->assertSame( '
', $actual ); + $this->assertEqualHTML( '
', $actual ); } public function data_wp_filter_pre_oembed_custom_result() { @@ -124,7 +185,7 @@ public function test_wp_filter_pre_oembed_custom_result( $html, $expected ) { 'html' => $html, ); $actual = _wp_oembed_get_object()->data2html( $data, 'https://untrusted.localhost' ); - $this->assertSame( $expected, $actual ); + $this->assertEqualHTML( $expected, $actual ); } /** @@ -134,6 +195,6 @@ public function test_filter_feed_content() { $html = ''; $actual = _oembed_filter_feed_content( wp_filter_oembed_result( $html, (object) array( 'type' => 'rich' ), '' ) ); - $this->assertSame( '', $actual ); + $this->assertEqualHTML( '', $actual ); } } diff --git a/tests/phpunit/tests/oembed/filterTitleAttributes.php b/tests/phpunit/tests/oembed/filterTitleAttributes.php index 7f35cac8ee48b..29d22f838af79 100644 --- a/tests/phpunit/tests/oembed/filterTitleAttributes.php +++ b/tests/phpunit/tests/oembed/filterTitleAttributes.php @@ -67,7 +67,7 @@ public function data_filter_oembed_iframe_title_attribute() { public function test_oembed_iframe_title_attribute( $html, $oembed_data, $url, $expected ) { $actual = wp_filter_oembed_iframe_title_attribute( $html, (object) $oembed_data, $url ); - $this->assertSame( $expected, $actual ); + $this->assertEqualHTML( $expected, $actual ); } public function test_filter_oembed_iframe_title_attribute() { @@ -84,7 +84,7 @@ public function test_filter_oembed_iframe_title_attribute() { remove_filter( 'oembed_iframe_title_attribute', array( $this, '_filter_oembed_iframe_title_attribute' ) ); - $this->assertSame( '', $actual ); + $this->assertEqualHTML( '', $actual ); } public function test_filter_oembed_iframe_title_attribute_does_not_modify_other_tags() { @@ -101,7 +101,7 @@ public function test_filter_oembed_iframe_title_attribute_does_not_modify_other_ remove_filter( 'oembed_iframe_title_attribute', array( $this, '_filter_oembed_iframe_title_attribute' ) ); - $this->assertSame( '
Baz
', $actual ); + $this->assertEqualHTML( 'Baz
', $actual ); } public function _filter_oembed_iframe_title_attribute() {