Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: the Lottie source is builder-only for users without unfiltered_html (P19)

Browse Source 
lottie.innerContent (src → data-lottie-src) makes the frontend load an
animation whose expressions lottie-web runs with eval; it joins the S7 gate
in ValueCleaner, which covers removals and StoredNodeGuard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
janniclas.loosen
2026-09-27 02:06:38 +02:00
co-authored by Claude Opus 5.5
parent 16c6d59725
commit 8fa285a265
6 changed files with 90 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php
+21
View File
@@ -232,4 +232,25 @@ final class ValueCleanerTest extends TestCase
self::assertSame('x', ComposeFixture::cleaner()->clean('divi/text', 'module.decoration.interactionsish', 'x'));
self::assertSame('x', ComposeFixture::cleaner()->clean('divi/text', 'module.advanced.interactions', 'x'));
}
/** Ruling P19: the Lottie source (lottie-web runs expressions with eval) is builder-only, at every depth. */
public function testLottieSourceNeedsUnfilteredHtml(): void
{
$value = ['src' => 'https://probe.example/anim.json', 'loop' => 'on'];
$paths = ['lottie.innerContent', 'lottie.innerContent.desktop', 'lottie.innerContent.desktop.value.src'];
foreach ($paths as $path) {
try {
ComposeFixture::cleaner()->clean('divi/lottie', $path, $value);
self::fail('Accepted for an editor: ' . $path);
} catch (InvalidArgumentException $e) {
self::assertStringContainsString('nur im Divi-Builder', $e->getMessage());
}
self::assertSame($value, ComposeFixture::cleaner(true)->clean('divi/lottie', $path, $value));
}
// The size of the animation and look-alike paths stay open.
self::assertSame('x', ComposeFixture::cleaner()->clean('divi/lottie', 'lottie.advanced.width', 'x'));
self::assertSame('x', ComposeFixture::cleaner()->clean('divi/lottie', 'lottie.innerContentish', 'x'));
}
}