From 3d1f8f292a0b9eb8fdc621c3288639c92368d173 Mon Sep 17 00:00:00 2001 From: Scott Taylor Date: Tue, 14 Jul 2015 17:55:07 +0000 Subject: [PATCH] After [33148]: Don't nest `esc_attr()` and `htmlspecialchars()` when escaping the post title on the edit post screen. Unrevert parts of [32851] and [32850]. Adds/alters unit tests. Props miqrogroove. Fixes #17780. git-svn-id: https://develop.svn.wordpress.org/trunk@33271 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/edit-form-advanced.php | 2 +- src/wp-includes/formatting.php | 21 ++----- tests/phpunit/tests/formatting/EscAttr.php | 4 +- tests/phpunit/tests/formatting/EscHtml.php | 2 +- tests/phpunit/tests/formatting/JSEscape.php | 6 +- .../tests/formatting/WPSpecialchars.php | 58 +++++++++++++++++++ 6 files changed, 70 insertions(+), 23 deletions(-) diff --git a/src/wp-admin/edit-form-advanced.php b/src/wp-admin/edit-form-advanced.php index 793ef8c253..7ada16cadd 100644 --- a/src/wp-admin/edit-form-advanced.php +++ b/src/wp-admin/edit-form-advanced.php @@ -494,7 +494,7 @@ do_action( 'edit_form_top', $post ); ?> $title_placeholder = apply_filters( 'enter_title_here', __( 'Enter title here' ), $post ); ?> - + assertEquals( "foo & bar &baz; '", $out ); + $out = esc_attr( 'foo & bar &baz;  ' ); + $this->assertEquals( "foo & bar &baz;  ", $out ); } } diff --git a/tests/phpunit/tests/formatting/EscHtml.php b/tests/phpunit/tests/formatting/EscHtml.php index 101692622e..14f17dfa8c 100644 --- a/tests/phpunit/tests/formatting/EscHtml.php +++ b/tests/phpunit/tests/formatting/EscHtml.php @@ -34,7 +34,7 @@ class Tests_Formatting_EscHtml extends WP_UnitTestCase { function test_ignores_existing_entities() { $source = '& £ " &'; - $res = '& £ " &'; + $res = '& £ " &'; $this->assertEquals( $res, esc_html($source) ); } } diff --git a/tests/phpunit/tests/formatting/JSEscape.php b/tests/phpunit/tests/formatting/JSEscape.php index 6ec3892982..286bf616e2 100644 --- a/tests/phpunit/tests/formatting/JSEscape.php +++ b/tests/phpunit/tests/formatting/JSEscape.php @@ -23,13 +23,13 @@ class Tests_Formatting_JSEscape extends WP_UnitTestCase { } function test_js_escape_amp() { - $out = esc_js('foo & bar &baz; ''); - $this->assertEquals("foo & bar &baz; '", $out); + $out = esc_js('foo & bar &baz;  '); + $this->assertEquals("foo & bar &baz;  ", $out); } function test_js_escape_quote_entity() { $out = esc_js('foo ' bar ' baz &'); - $this->assertEquals("foo \\' bar \\' baz &", $out); + $this->assertEquals("foo \\' bar \\' baz &", $out); } function test_js_no_carriage_return() { diff --git a/tests/phpunit/tests/formatting/WPSpecialchars.php b/tests/phpunit/tests/formatting/WPSpecialchars.php index 6c8765d4db..ddae7fdefa 100644 --- a/tests/phpunit/tests/formatting/WPSpecialchars.php +++ b/tests/phpunit/tests/formatting/WPSpecialchars.php @@ -17,6 +17,10 @@ class Tests_Formatting_WPSpecialchars extends WP_UnitTestCase { // Allowed entities should be unchanged foreach ( $allowedentitynames as $ent ) { + if ( 'apos' == $ent ) { + // But for some reason, PHP doesn't allow ' + continue; + } $ent = '&' . $ent . ';'; $this->assertEquals( $ent, _wp_specialchars( $ent ) ); } @@ -39,4 +43,58 @@ class Tests_Formatting_WPSpecialchars extends WP_UnitTestCase { $this->assertEquals( '"'hello!'"', _wp_specialchars($source, true) ); $this->assertEquals( $source, _wp_specialchars($source) ); } + + /** + * Check some of the double-encoding features for entity references. + * + * @ticket 17780 + * @dataProvider data_double_encoding + */ + function test_double_encoding( $input, $output ) { + return $this->assertEquals( $output, _wp_specialchars( $input, ENT_NOQUOTES, false, true ) ); + } + + function data_double_encoding() { + return array( + array( + 'This & that, this & that, — " " Ú   " " " " " $ ×', + 'This & that, this & that, — " " Ú   " " " " " $ ×', + ), + array( + '&& && && &;', + '&& && && &;', + ), + array( + '&garbage; &***; &aaaa; &0000; &####; &;;', + '&garbage; &***; &aaaa; &0000; &####; &;;', + ), + ); + } + + /** + * Check some of the double-encoding features for entity references. + * + * @ticket 17780 + * @dataProvider data_no_double_encoding + */ + function test_no_double_encoding( $input, $output ) { + return $this->assertEquals( $output, _wp_specialchars( $input, ENT_NOQUOTES, false, false ) ); + } + + function data_no_double_encoding() { + return array( + array( + 'This & that, this & that, — " " Ú   " " " " " $ ×', + 'This & that, this & that, — " " Ú   " " " " " $ ×', + ), + array( + '&& && && &;', + '&& && && &;', + ), + array( + '&garbage; &***; &aaaa; &0000; &####; &;;', + '&garbage; &***; &aaaa; &0000; &####; &;;', + ), + ); + } }