Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

test: shared Divi fixtures in tests/Support (T1)

Browse Source 
- DiviFixtures: markup(), givenPost(), schema(), designSystem(), catalog(),
  dynamicContentRegistry(), maliciousRefs() - moved verbatim out of
  DiviPageLoaderTest, DesignSystemTest, ModuleCatalogTest, DynamicContentMapTest
  and VariableRefTest (its malicious() provider now returns maliciousRefs()).
- ComposeFixture moves to tests/Support.
- DiviWriterFixture: modules(), designReader(), composition(), a recording saver(),
  log() and writer(&$saved, &$failures, unfiltered, loader) for the five tests that
  wired the Divi write stack by hand.
No test cases or assertions changed (1397 / 5834).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
janniclas.loosen
2026-09-26 17:47:11 +02:00
co-authored by Claude Opus 5.5
parent d2cc8497c9
commit 3d96a41366
24 changed files with 489 additions and 404 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Support/ComposeFixture.php
+172
View File
@@ -0,0 +1,172 @@
<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Support;
use LIT\MCP\Integrations\Divi\Compose\AttrWriter;
use LIT\MCP\Integrations\Divi\Compose\Composer;
use LIT\MCP\Integrations\Divi\Compose\MediaResolver;
use LIT\MCP\Integrations\Divi\Compose\Placeholders;
use LIT\MCP\Integrations\Divi\Compose\ShortformWriter;
use LIT\MCP\Integrations\Divi\Compose\StructureRules;
use LIT\MCP\Integrations\Divi\Compose\ValueSanitizer;
use LIT\MCP\Integrations\Divi\Design\DesignSystem;
/**
* Compose classes wired with the real Divi 5.2.1 sample catalog, the sample design system and
* predictable fakes for sanitizing and media (no WordPress). $unfiltered switches the fake
* sanitizer between a user with and without unfiltered_html (ruling S7).
*/
final class ComposeFixture
{
/** A valid content reference as an attachment's alt text (media ids 44 and 45). */
public const REFERENCE_ALT = '$variable({"type":"content","value":{"name":"post_title","settings":{}}})$';
public static function sanitizer(bool $unfiltered = false): ValueSanitizer
{
return new class ($unfiltered) implements ValueSanitizer {
public function __construct(private bool $unfiltered)
{
}
/**
* Like sanitize_text_field (_sanitize_text_fields): tags only go when there is a "<"
* (wp_strip_all_tags; PHP's strip_tags also drops NUL then), whitespace runs become one
* space, trim, %XX octets go repeatedly. Without a "<", NUL and other control
* characters stay – as in WordPress (ruling S32: AttrWriter strips them).
*/
public function text(string $value): string
{
if (str_contains($value, '<')) {
$value = strip_tags((string) preg_replace('@<(script|style)[^>]*?>.*?</\\1>@si', '', $value));
}
$value = trim((string) preg_replace('/[\r\n\t ]+/', ' ', $value));
$found = false;
while (preg_match('/%[a-f0-9]{2}/i', $value, $match) === 1) {
$value = str_replace($match[0], '', $value);
$found = true;
}
return $found ? trim((string) preg_replace('/ +/', ' ', $value)) : $value;
}
/**
* Like WpValueSanitizer (ruling S4): raw for users with unfiltered_html; otherwise like
* wp_kses_post: NUL bytes, <script> blocks and tags outside a small allow list go.
*/
public function html(string $value): string
{
if ($this->unfiltered) {
return $value;
}
$value = (string) preg_replace('#<script\b[^>]*>.*?</script>#is', '', str_replace(chr(0), '', $value));
return (string) preg_replace(
'#</?(?!(?:p|b|i|em|strong|a|br|span|h[1-6]|ul|ol|li)\b)[a-z][^>]*>#i',
'',
$value
);
}
public function code(string $value): string
{
return $value;
}
/**
* Like esc_url_raw: spaces become %20, characters outside its allow list (tags, quotes,
* braces, NUL) go, %0d/%0a are removed repeatedly, javascript: gives ''.
*/
public function url(string $value): string
{
$value = str_replace(' ', '%20', trim($value));
$value = (string) preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\[\]\x80-\xff]|i', '', $value);
do {
$before = $value;
$value = str_replace(['%0d', '%0a', '%0D', '%0A'], '', $value);
} while ($value !== $before);
return str_starts_with(strtolower($value), 'javascript:') ? '' : $value;
}
public function allowsUnfilteredHtml(): bool
{
return $this->unfiltered;
}
/** Every post is readable but 666 (ruling S37, select_post settings). */
public function canReadPost(int $id): bool
{
return $id !== 666;
}
};
}
public static function media(): MediaResolver
{
return new class implements MediaResolver {
public function image(int $id): ?array
{
return match ($id) {
33 => ['url' => 'https://kunde.test/wp-content/uploads/team.jpg', 'alt' => 'Unser Team'],
12 => ['url' => 'https://kunde.test/wp-content/uploads/halle.jpg', 'alt' => ''],
// Alt texts carrying a reference, whole or NUL-split (ruling S33b: dropped).
44 => ['url' => 'https://kunde.test/wp-content/uploads/a.jpg', 'alt' => ComposeFixture::REFERENCE_ALT],
// "<" + VT/FF: strip_tags keeps it as text – a later strip would build the tag (S32a).
46 => ['url' => 'https://kunde.test/wp-content/uploads/c.jpg', 'alt' => '<' . chr(11)
. 'img src=x onerror=alert(1)>Team'],
45 => ['url' => 'https://kunde.test/wp-content/uploads/b.jpg', 'alt' => '$variable' . chr(0)
. substr(ComposeFixture::REFERENCE_ALT, strlen('$variable'))],
default => null,
};
}
};
}
public static function placeholders(): Placeholders
{
return new Placeholders(DiviFixtures::designSystem());
}
public static function attrWriter(bool $unfiltered = false): AttrWriter
{
return new AttrWriter(DiviFixtures::catalog(), self::placeholders(), self::sanitizer($unfiltered));
}
/**
* @param array<string, array<string, array<string, mixed>>>|null $modules Short form per
* type instead of ShortformMap (to reach paths the curated map never names).
*/
public static function shortform(bool $unfiltered = false, ?array $modules = null): ShortformWriter
{
return new ShortformWriter(self::placeholders(), self::media(), self::attrWriter($unfiltered), $modules);
}
public static function rules(): StructureRules
{
return new StructureRules(DiviFixtures::catalog());
}
/**
* Builder version 5.2.1. $design replaces the sample design system (one Placeholders instance
* shared by AttrWriter and ShortformWriter, like the live wiring – ruling S31).
*/
public static function composer(bool $unfiltered = false, ?DesignSystem $design = null): Composer
{
$design ??= DiviFixtures::designSystem();
$placeholders = new Placeholders($design);
$attrWriter = new AttrWriter(DiviFixtures::catalog(), $placeholders, self::sanitizer($unfiltered));
return new Composer(
DiviFixtures::catalog(),
self::rules(),
new ShortformWriter($placeholders, self::media(), $attrWriter),
$attrWriter,
$design,
'5.2.1'
);
}
}
tests/Support/DiviFixtures.php
+231
View File
@@ -0,0 +1,231 @@
<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Support;
use Brain\Monkey\Functions;
use LIT\MCP\Integrations\Divi\Design\DesignSystem;
use LIT\MCP\Integrations\Divi\Schema\ModuleCatalog;
use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
use Mockery;
use WP_Post;
/**
* Shared Divi test data: page markup, the stubbed post of the page tests, the sample design
* system and module catalog (real Divi 5.2.1 shapes), the dynamic content registry and the
* malicious $variable rows the Compose tests feed into every write path.
*/
final class DiviFixtures
{
/** A Divi page markup file from tests/Fixtures/divi. */
public static function markup(string $name): string
{
return (string) file_get_contents(dirname(__DIR__) . '/Fixtures/divi/' . $name);
}
/** Stubs everything PostGuard::editable() needs for a post with $content. */
public static function givenPost(string $content, array $fields = []): WP_Post
{
$post = new WP_Post(array_merge(
['ID' => 7, 'post_type' => 'page', 'post_status' => 'draft', 'post_title' => 'Start', 'post_content' => $content],
$fields
));
Functions\when('get_post')->justReturn($post);
Functions\when('current_user_can')->justReturn(true);
Functions\when('get_permalink')->justReturn('https://kunde.test/?page_id=7');
Functions\when('add_query_arg')->alias(static fn (string $key, string $value, string $url): string => $url . '&' . $key . '=' . $value);
return $post;
}
public static function schema(bool $diviEnabled = true): ContentSchema
{
$schema = Mockery::mock(ContentSchema::class);
$schema->allows('isManaged')->andReturn(true);
$schema->allows('diviEnabled')->andReturn($diviEnabled);
return $schema;
}
/** Shapes as GlobalData / GlobalPreset return them (Divi 5.2.1, verified in DDEV). */
public static function designSystem(): DesignSystem
{
return DesignSystem::fromDivi(
[
'gcid-primary-color' => ['color' => '#2ea3f2', 'label' => 'Primärfarbe', 'status' => 'active'],
'gcid-body-color' => ['color' => '#666666', 'label' => 'Fließtextfarbe', 'status' => 'active'],
'gcid-a1b2' => ['color' => '#0b3d59', 'label' => 'Nachtblau', 'status' => 'active'],
'gcid-old' => ['color' => '#ff0000', 'label' => 'Alt', 'status' => 'inactive'],
],
[
'numbers' => ['gvid-r1' => ['id' => 'gvid-r1', 'label' => 'Radius', 'value' => '8px', 'status' => 'active']],
'strings' => ['gvid-s1' => ['id' => 'gvid-s1', 'label' => 'Telefon', 'value' => '0221 123', 'status' => 'active']],
// Divi returns every variable type as stdClass (verified in DDEV).
'fonts' => (object) [
'--et_global_heading_font' => ['id' => '--et_global_heading_font', 'label' => 'Überschrift', 'value' => 'Open Sans', 'status' => 'active'],
'--et_global_body_font' => ['id' => '--et_global_body_font', 'label' => 'Fließtext', 'value' => 'Lato', 'status' => 'active'],
],
'links' => new \stdClass(),
],
[
'module' => ['divi/button' => ['default' => 'p-1', 'items' => [
'p-1' => ['id' => 'p-1', 'name' => 'Standard', 'moduleName' => 'divi/button'],
'p-2' => ['id' => 'p-2', 'name' => 'CTA primär', 'moduleName' => 'divi/button'],
]]],
'group' => ['divi/font' => ['default' => '', 'items' => [
'g-1' => ['id' => 'g-1', 'name' => 'Fließtext groß', 'groupName' => 'divi/font'],
]]],
],
['body_font_size' => '16']
);
}
/** Real Divi 5.2.1 metadata (tests/Integration/divi-metadata-fixture.php). */
public static function catalog(): ModuleCatalog
{
$sample = json_decode(
(string) file_get_contents(dirname(__DIR__) . '/Fixtures/divi/metadata-sample.json'),
true
);
return new ModuleCatalog(
$sample['metadata'],
static fn (string $name): array => (array) ($sample['defaults'][$name] ?? [])
);
}
/**
* Shape of DynamicContentOptions::get_options($pageId, 'edit') in Divi 5.2.1 (excerpt of a
* live dump for a page: no post_categories/post_tags – pages have no such taxonomies).
*
* @return array<string, array<string, mixed>>
*/
public static function dynamicContentRegistry(): array
{
$text = static fn (): array => ['label' => 'x', 'type' => 'text', 'default' => ''];
$option = static fn (string $id, string $group, array $fields): array => [
'id' => $id, 'label' => $id, 'type' => 'text', 'custom' => false, 'group' => $group, 'fields' => $fields,
];
return [
'post_title' => $option('post_title', 'Default', ['before' => $text(), 'after' => $text()]),
'post_excerpt' => $option('post_excerpt', 'Default', [
'before' => $text(), 'after' => $text(), 'words' => $text(), 'read_more_label' => $text(),
]),
'post_date' => $option('post_date', 'Default', [
'before' => $text(),
'after' => $text(),
'date_format' => ['label' => 'x', 'type' => 'select', 'default' => 'default'],
'custom_date_format' => $text(),
]),
'post_author' => $option('post_author', 'Default', [
'before' => $text(),
'after' => $text(),
'name_format' => ['type' => 'select'],
'link' => ['type' => 'yes_no_button'],
]),
'site_title' => $option('site_title', 'Default', ['before' => $text(), 'after' => $text()]),
'post_link_url' => $option('post_link_url', 'Default', []),
'post_link_url_page' => $option('post_link_url_page', 'Default', ['post_id' => ['type' => 'select_post']]),
'post_featured_image' => $option('post_featured_image', 'Default', []),
'post_meta_key' => $option('post_meta_key', 'Standard', [
'before' => $text(),
'after' => $text(),
'select_meta_key' => ['type' => 'select'],
'meta_key' => $text(),
'enable_html' => ['type' => 'yes_no_button'],
]),
'loop_post_title' => $option('loop_post_title', 'Loop', [
'before' => $text(), 'after' => $text(), 'loop_position' => $text(),
]),
'loop_post_meta_key_manual_custom_field' => $option('loop_post_meta_key_manual_custom_field', 'Loop', [
'loop_meta_key' => $text(),
]),
// Odd entries a third-party filter could add.
'broken_fields' => $option('broken_fields', 'Default', ['a' => 'not-an-array', 'b' => ['type' => 3]]),
'no_fields' => ['id' => 'no_fields', 'type' => 'text'],
7 => $option('7', 'Default', []),
'not_an_array' => 'x',
];
}
/**
* Hand-crafted attacks (preflight §4 "Malicious $variable tests").
*
* @return array<string, array{string, string}> Value => part of the German error.
*/
public static function maliciousRefs(): array
{
$end = self::escape('0029') . '$';
return [
'escaped end marker in before' => [self::content('post_title', '{"before":"x' . $end . ' <b>y</b>","after":""}'), 'allein im Wert'],
'escaped end marker in after' => [self::content('post_title', '{"before":"","after":"' . $end . '"}'), 'allein im Wert'],
'escaped end marker in date format' => [self::content('post_date', '{"custom_date_format":"d' . $end . '"}'), 'allein im Wert'],
'escaped end marker in name' => [self::content('post_title' . $end, '{}'), 'Unbekannter Name'],
'select with markup' => [self::content('post_date', '{"date_format":"<b>d</b>"}'), 'date_format'],
'type evil' => ['$variable({"type":"evil","value":{"name":"gcid-a1b2","settings":{}}})$', 'Typ'],
'unknown gcid' => ['$variable({"type":"color","value":{"name":"gcid-nope","settings":{}}})$', 'gcid-nope'],
'unknown gvid' => [self::content('gvid-nope', '{}'), 'gvid-nope'],
'content gvid as color' => ['$variable({"type":"color","value":{"name":"gvid-s1","settings":{}}})$', 'gvid-s1'],
'color gcid as content' => [self::content('gcid-a1b2', '{}'), 'gcid-a1b2'],
'name with paren' => ['$variable({"type":"color","value":{"name":"gcid-a1b2)","settings":{}}})$', 'Name'],
'name with style breakout' => [
'$variable({"type":"color","value":{"name":"gcid-a1b2;}</style><script>alert(1)</script>","settings":{}}})$',
'Name',
],
'settings on a global variable' => [self::content('gvid-s1', '{"before":"<b>x</b>"}'), 'before'],
'settings on a theme font' => [self::content('--et_global_heading_font', '{"after":""}'), 'after'],
'unknown settings key' => [self::content('post_title', '{"before":"","foo":"1"}'), 'foo'],
'setting the option lacks' => [self::content('post_featured_image', '{"before":"x"}'), 'before'],
'enable_html' => [self::content('custom_meta_telefon', '{"before":"","after":"","enable_html":"on"}'), 'enable_html'],
'color setting not numeric' => [
'$variable({"type":"color","value":{"name":"gcid-a1b2","settings":{"opacity":"1;}</style>"}}})$',
'opacity',
],
'protected meta key' => [self::content('custom_meta__edit_lock', '{}'), 'custom_meta__edit_lock'],
'doubled meta prefix' => [
self::content('custom_meta_custom_meta__edit_lock', '{}'),
'custom_meta_custom_meta__edit_lock',
],
'loop content outside a loop' => [self::content('loop_post_title', '{}'), 'loop_post_title'],
'unknown dynamic content' => [self::content('post_meta_key', '{}'), 'post_meta_key'],
'extra top-level key' => ['$variable({"type":"color","value":{"name":"gcid-a1b2","settings":{}},"x":1})$', 'x'],
'extra value key' => ['$variable({"type":"color","value":{"name":"gcid-a1b2","settings":{},"x":1}})$', 'x'],
'greedy smuggling' => ['$variable({"a":"})$<script>alert(1)</script>"})$', 'allein im Wert'],
'nested reference in before' => [self::content('post_title', '{"before":"$variable(x)$","after":""}'), 'allein im Wert'],
// S28: a marker the sanitizer rebuilds inside a cleaned setting (html(), text()).
'tag-split marker in before' => [self::content('post_title', '{"before":"$variable<x>(y","after":""}'), 'allein im Wert'],
'NUL-split marker in after' => [
self::content('post_title', '{"before":"","after":"$variable' . self::escape('0000') . '(y"}'),
'allein im Wert',
],
'octet-split marker in date format' => [self::content('post_date', '{"custom_date_format":"$variable%41(y"}'), 'allein im Wert'],
// S32: text() keeps control characters (like sanitize_text_field); VariableRef strips them.
'NUL-split marker in date format' => [
self::content('post_date', '{"custom_date_format":"$variable' . self::escape('0000') . '(y"}'),
'allein im Wert',
],
'DEL-split marker in date format' => [
self::content('post_date', '{"custom_date_format":"$variable' . self::escape('007f') . '(y"}'),
'allein im Wert',
],
'nested marker in before' => [self::content('post_title', '{"before":"$variable(","after":""}'), 'allein im Wert'],
'broken json' => ['$variable(kaputt)$', 'JSON'],
'trailing text' => [self::content('post_title', '{}') . ' ', 'allein im Wert'],
'embedded in text' => ['<p>Hi ' . self::content('post_title', '{"before":"","after":""}') . '</p>', 'allein im Wert'],
];
}
private static function content(string $name, string $settings): string
{
return '$variable({"type":"content","value":{"name":"' . $name . '","settings":' . $settings . '}})$';
}
/** A JSON "\uXXXX" escape, built from bytes so no tool turns it into the character itself. */
private static function escape(string $hex): string
{
return chr(92) . 'u' . $hex;
}
}
tests/Support/DiviWriterFixture.php
+117
View File
@@ -0,0 +1,117 @@
<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Support;
use LIT\MCP\ChangeLog\ChangeLog;
use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
use LIT\MCP\Integrations\Divi\Pages\DiviComposition;
use LIT\MCP\Integrations\Divi\Pages\DiviPageLoader;
use LIT\MCP\Integrations\Divi\Pages\DiviSaver;
use LIT\MCP\Integrations\Divi\Pages\DiviWriter;
use LIT\MCP\Integrations\Divi\Pages\DynamicContentMap;
use LIT\MCP\Integrations\Divi\Schema\DiviModules;
use Mockery;
use Throwable;
use WP_Post;
/**
* The Divi write stack of the page tests: DiviModules and DesignSystemReader serve the sample
* catalog (builder 5.2.1) and design system, DiviComposition uses ComposeFixture's sanitizer and
* media, and the saver records what it saves instead of touching the database.
*/
final class DiviWriterFixture
{
public static function modules(): DiviModules
{
$modules = Mockery::mock(DiviModules::class);
$modules->allows('catalog')->andReturn(DiviFixtures::catalog());
$modules->allows('builderVersion')->andReturn('5.2.1');
return $modules;
}
public static function designReader(): DesignSystemReader
{
$design = Mockery::mock(DesignSystemReader::class);
$design->allows('read')->andReturn(DiviFixtures::designSystem());
return $design;
}
/**
* $design is the reader the writer gets too (one instance, like the live wiring); without
* $registry the composition uses DynamicContentMap's default (VariableRef's built-in map in
* unit tests, where Divi's classes are missing).
*/
public static function composition(
DesignSystemReader $design,
bool $unfiltered = false,
?DynamicContentMap $registry = null
): DiviComposition {
return new DiviComposition(
self::modules(),
$design,
ComposeFixture::sanitizer($unfiltered),
ComposeFixture::media(),
$registry ?? new DynamicContentMap()
);
}
/**
* A DiviSaver whose save() appends the content to $saved, puts it on the post and reports
* revision 811. Each call first takes the next entry of $failures and throws it, if any.
*
* @param list<string> $saved
* @param list<Throwable> $failures
*/
public static function saver(array &$saved, array &$failures = []): DiviSaver
{
$saver = Mockery::mock(DiviSaver::class);
$saver->allows('save')->andReturnUsing(static function (WP_Post $post, string $content) use (&$saved, &$failures): array {
$failure = array_shift($failures);
if ($failure !== null) {
throw $failure;
}
$saved[] = $content;
$post->post_content = $content;
return ['revision_id' => 811, 'warnings' => []];
});
return $saver;
}
/** A ChangeLog that accepts every record (log id 4711). */
public static function log(): ChangeLog
{
$log = Mockery::mock(ChangeLog::class);
$log->allows('record')->andReturn(4711);
return $log;
}
/**
* The writer over the page of DiviFixtures::givenPost(), saving into $saved (see saver()).
*
* @param list<string> $saved
* @param list<Throwable> $failures
*/
public static function writer(
array &$saved,
array &$failures = [],
bool $unfiltered = false,
?DiviPageLoader $loader = null
): DiviWriter {
$design = self::designReader();
return new DiviWriter(
$loader ?? new DiviPageLoader(DiviFixtures::schema()),
self::saver($saved, $failures),
self::log(),
$design,
self::composition($design, $unfiltered)
);
}
}