I-1: reject )$ in every decoded string setting and in the re-serialized JSON. S21: string settings cleaned and re-serialized. S22: injectable dynamic-content allow map (name => setting => field type), loop_* only via the map. S23: unknown content.innerContent is rich text. S24: keys below scalar kinds are unknown, ...Url path segments are URLs. S25: isVariable removed. M-1: real \u escapes in tests, malicious suite as editor, fixture html() raw for unfiltered_html. M-2: S7 gate at any depth plus css.advanced.customCss. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
80 lines
2.6 KiB
PHP
80 lines
2.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace LIT\MCP\Tests\Unit\Integrations\Divi\Compose;
|
|
|
|
use LIT\MCP\Integrations\Divi\Compose\AttrWriter;
|
|
use LIT\MCP\Integrations\Divi\Compose\MediaResolver;
|
|
use LIT\MCP\Integrations\Divi\Compose\Placeholders;
|
|
use LIT\MCP\Integrations\Divi\Compose\ValueSanitizer;
|
|
use LIT\MCP\Tests\Unit\Integrations\Divi\Design\DesignSystemTest;
|
|
use LIT\MCP\Tests\Unit\Integrations\Divi\Schema\ModuleCatalogTest;
|
|
|
|
/**
|
|
* Compose classes wired with the real Divi 5.2.1 sample catalog, the sample design system and
|
|
* predictable fakes for sanitizing and media (no WordPress). $unfiltered switches the fake
|
|
* sanitizer between a user with and without unfiltered_html (ruling S7).
|
|
*/
|
|
final class ComposeFixture
|
|
{
|
|
public static function sanitizer(bool $unfiltered = false): ValueSanitizer
|
|
{
|
|
return new class ($unfiltered) implements ValueSanitizer {
|
|
public function __construct(private bool $unfiltered)
|
|
{
|
|
}
|
|
|
|
public function text(string $value): string
|
|
{
|
|
return trim(strip_tags($value));
|
|
}
|
|
|
|
/** Like WpValueSanitizer (ruling S4): raw for users with unfiltered_html. */
|
|
public function html(string $value): string
|
|
{
|
|
return $this->unfiltered ? $value : (string) preg_replace('#<script\b[^>]*>.*?</script>#is', '', $value);
|
|
}
|
|
|
|
public function code(string $value): string
|
|
{
|
|
return $value;
|
|
}
|
|
|
|
public function url(string $value): string
|
|
{
|
|
return str_starts_with(strtolower(trim($value)), 'javascript:') ? '' : trim($value);
|
|
}
|
|
|
|
public function allowsUnfilteredHtml(): bool
|
|
{
|
|
return $this->unfiltered;
|
|
}
|
|
};
|
|
}
|
|
|
|
public static function media(): MediaResolver
|
|
{
|
|
return new class implements MediaResolver {
|
|
public function image(int $id): ?array
|
|
{
|
|
return match ($id) {
|
|
33 => ['url' => 'https://kunde.test/wp-content/uploads/team.jpg', 'alt' => 'Unser Team'],
|
|
12 => ['url' => 'https://kunde.test/wp-content/uploads/halle.jpg', 'alt' => ''],
|
|
default => null,
|
|
};
|
|
}
|
|
};
|
|
}
|
|
|
|
public static function placeholders(): Placeholders
|
|
{
|
|
return new Placeholders(DesignSystemTest::sample());
|
|
}
|
|
|
|
public static function attrWriter(bool $unfiltered = false): AttrWriter
|
|
{
|
|
return new AttrWriter(ModuleCatalogTest::sampleCatalog(), self::placeholders(), self::sanitizer($unfiltered));
|
|
}
|
|
}
|