From fe8a01f878ac7f16941aca5f6a3e15c7fdc45c84 Mon Sep 17 00:00:00 2001 From: Jan-Niclas Loosen Date: Fri, 16 Oct 2026 18:03:21 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20Sicherheitstest=20f=C3=BCr=20Redakteure?= =?UTF-8?q?=20ohne=20unfiltered=5Fhtml=20pr=C3=BCft=20einen=20echten=20Bui?= =?UTF-8?q?lder-Pfad?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- .../Divi/Design/DiviPresetsSetAbilityTest.php | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/tests/Unit/Integrations/Divi/Design/DiviPresetsSetAbilityTest.php b/tests/Unit/Integrations/Divi/Design/DiviPresetsSetAbilityTest.php index a0b6e0c..b668551 100644 --- a/tests/Unit/Integrations/Divi/Design/DiviPresetsSetAbilityTest.php +++ b/tests/Unit/Integrations/Divi/Design/DiviPresetsSetAbilityTest.php @@ -145,15 +145,20 @@ final class DiviPresetsSetAbilityTest extends TestCase self::assertArrayHasKey('items[1]', $result['fields']); } - public function testEditorWithoutUnfilteredHtmlIsRefusedForRawCss(): void + /** Review Focus 1 (final review I-1): a catalog-known builder-only path, refused for editors only. */ + public function testEditorWithoutUnfilteredHtmlIsRefusedForBuilderOnlyFields(): void { - $result = $this->ability(false)->execute(['items' => [[ - 'module' => 'button', 'name' => 'Mit CSS', - 'attrs' => ['css' => ['desktop' => ['mainElement' => 'color:red']]], - ]]]); + $input = ['items' => [[ + 'module' => 'button', 'name' => 'Mit HTML', + 'attrs' => ['module.advanced.html' => ['desktop' => ['elementType' => 'div']]], + ]]]; - self::assertNotTrue(is_array($result) && ($result['ok'] ?? false)); - self::assertContains(Errors::codeOf($result), ['validation_failed', 'invalid_attr_path']); + $editor = self::assertToolError($this->ability(false)->execute($input), 'validation_failed'); + self::assertArrayHasKey('items[0].attrs.module.advanced.html', $editor['fields']); + self::assertStringContainsString('Divi-Builder', $editor['fields']['items[0].attrs.module.advanced.html']); + self::assertStringContainsString('unfiltered_html', $editor['fields']['items[0].attrs.module.advanced.html']); + + self::assertToolError($this->ability(true)->execute($input), 'confirm_required'); } public function testFromNodeReadsThePage(): void