Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: bound render-summary strings, restore postdata globals, drain buffers

Browse Source 
Review fix round 1 for lit/page-render-summary: extract shared Text::shorten()
(reused by NodeSummary), replace data: URIs with a short marker, prefer
data-src/data-lazy-src over placeholder src, dedup nested p/li/blockquote
text and ignore script/style/noscript content, restore every setup_postdata
global (not just $post), drain output buffers robustly around the_content,
and disclose that rendering can trigger oEmbed/network requests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 12:31:20 +02:00
co-authored by Claude Opus 5.5
parent 2e9acd686a
commit b3cd0eee62
7 changed files with 345 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/WordPress/Render/PageRendererTest.php
+73 -6
View File
@@ -13,20 +13,40 @@ use WP_Post;
final class PageRendererTest extends TestCase
{
private const POSTDATA_GLOBALS = ['id', 'authordata', 'pages', 'page', 'more', 'numpages', 'multipage'];
protected function tearDown(): void
{
unset($GLOBALS['post']);
foreach (self::POSTDATA_GLOBALS as $name) {
unset($GLOBALS[$name]);
}
parent::tearDown();
}
public function testRendersTheContentFilterAndRestoresTheGlobalPost(): void
public function testRendersTheContentFilterAndRestoresGlobalPostAndPostdata(): void
{
$previous = new WP_Post(['ID' => 1]);
$GLOBALS['post'] = $previous;
$previousPost = new WP_Post(['ID' => 1]);
$GLOBALS['post'] = $previousPost;
$GLOBALS['id'] = 1;
$GLOBALS['authordata'] = 'previous-author';
$GLOBALS['pages'] = ['previous'];
$GLOBALS['page'] = 1;
$GLOBALS['more'] = 1;
$GLOBALS['numpages'] = 1;
$GLOBALS['multipage'] = 0;
$post = new WP_Post(['ID' => 7, 'post_content' => '<!-- wp:divi/section /-->']);
$setup = [];
Functions\when('setup_postdata')->alias(static function (WP_Post $p) use (&$setup): bool {
$setup[] = $p->ID;
$GLOBALS['id'] = $p->ID;
$GLOBALS['authordata'] = 'author-of-' . $p->ID;
$GLOBALS['pages'] = ['page-of-' . $p->ID];
$GLOBALS['page'] = 2;
$GLOBALS['more'] = 0;
$GLOBALS['numpages'] = 3;
$GLOBALS['multipage'] = 1;
return true;
});
@@ -41,14 +61,20 @@ final class PageRendererTest extends TestCase
$html = (new PageRenderer())->render($post);
self::assertSame('<p>echoed</p><div class="et_pb_section"></div>', $html);
self::assertSame($previous, $GLOBALS['post']);
self::assertSame([7, 1], $setup);
self::assertSame([7], $setup);
self::assertSame($previousPost, $GLOBALS['post']);
self::assertSame(1, $GLOBALS['id']);
self::assertSame('previous-author', $GLOBALS['authordata']);
self::assertSame(['previous'], $GLOBALS['pages']);
self::assertSame(1, $GLOBALS['page']);
self::assertSame(1, $GLOBALS['more']);
self::assertSame(1, $GLOBALS['numpages']);
self::assertSame(0, $GLOBALS['multipage']);
}
public function testRestoresEvenWhenRenderingThrows(): void
{
Functions\when('setup_postdata')->justReturn(true);
Functions\expect('wp_reset_postdata')->once();
Filters\expectApplied('the_content')->once()->andReturnUsing(static function (): string {
throw new RuntimeException('module crashed');
});
@@ -59,6 +85,47 @@ final class PageRendererTest extends TestCase
} catch (RuntimeException) {
self::assertArrayHasKey('post', $GLOBALS);
self::assertNull($GLOBALS['post']);
foreach (self::POSTDATA_GLOBALS as $name) {
self::assertArrayHasKey($name, $GLOBALS);
self::assertNull($GLOBALS[$name]);
}
}
}
public function testDrainsAnExtraOutputBufferAShortcodeLeavesOpen(): void
{
Functions\when('setup_postdata')->justReturn(true);
Filters\expectApplied('the_content')->once()->andReturnUsing(static function (): string {
echo 'before-';
ob_start(); // a buggy shortcode opens a buffer and never closes it
echo 'leaked';
return 'html';
});
$levelBefore = ob_get_level();
$html = (new PageRenderer())->render(new WP_Post(['ID' => 7]));
self::assertSame('before-leakedhtml', $html);
self::assertSame($levelBefore, ob_get_level());
}
public function testToleratesAShortcodeThatClosesOneOutputBufferTooMany(): void
{
Functions\when('setup_postdata')->justReturn(true);
Filters\expectApplied('the_content')->once()->andReturnUsing(static function (): string {
ob_start(); // shortcode's own nested buffer
echo 'own';
ob_end_clean(); // correct: closes its own buffer
ob_end_clean(); // bug: also closes PageRenderer's buffer
return 'html';
});
$levelBefore = ob_get_level();
$html = (new PageRenderer())->render(new WP_Post(['ID' => 7]));
self::assertSame('html', $html);
self::assertSame($levelBefore, ob_get_level());
}
}