From 6973cf86901af4f81693ed6b64200a574906500f Mon Sep 17 00:00:00 2001 From: Matias Benedetto Date: Tue, 3 Sep 2024 08:39:21 -0300 Subject: [PATCH] Update escaping function (#683) * Update escaping function * update tests * add method specific for attributes * update tests * Updates to only use wp_kses_post when strings contain html * remove wp_kses_post as escaping function * update tests --------- Co-authored-by: Grant Kinney --- includes/create-theme/theme-locale.php | 40 +++++++++++-- includes/create-theme/theme-patterns.php | 2 +- tests/CbtThemeLocale/escapeAttribute.php | 58 +++++++++++++++++++ tests/CbtThemeLocale/escapeString.php | 48 --------------- tests/CbtThemeLocale/escapeTextContent.php | 56 ++++++++++++++++++ .../escapeTextContentOfBlocks.php | 10 +--- tests/test-theme-templates.php | 43 ++++++++++---- 7 files changed, 185 insertions(+), 72 deletions(-) create mode 100644 tests/CbtThemeLocale/escapeAttribute.php delete mode 100644 tests/CbtThemeLocale/escapeString.php create mode 100644 tests/CbtThemeLocale/escapeTextContent.php diff --git a/includes/create-theme/theme-locale.php b/includes/create-theme/theme-locale.php index 343b855e..783d8715 100644 --- a/includes/create-theme/theme-locale.php +++ b/includes/create-theme/theme-locale.php @@ -5,26 +5,58 @@ class CBT_Theme_Locale { /** - * Escape a string for localization. + * Escape text for localization. * * @param string $string The string to escape. * @return string The escaped string. */ - public static function escape_string( $string ) { + private static function escape_text_content( $string ) { // Avoid escaping if the text is not a string. if ( ! is_string( $string ) ) { return $string; } + // Check if string is empty. + if ( '' === $string ) { + return $string; + } + // Check if the text is already escaped. if ( str_starts_with( $string, 'get( 'TextDomain' ) . "');?>"; } + /** + * Escape an html element attribute for localization. + * + * @param string $string The string to escape. + * @return string The escaped string. + */ + private static function escape_attribute( $string ) { + // Avoid escaping if the text is not a string. + if ( ! is_string( $string ) ) { + return $string; + } + + // Check if string is empty. + if ( '' === $string ) { + return $string; + } + + // Check if the text is already escaped. + if ( str_starts_with( $string, 'get( 'TextDomain' ) . "');?>"; + } + /** * Get a replacement pattern for escaping the text from the html content of a block. * @@ -109,7 +141,7 @@ public static function escape_text_content_of_blocks( $blocks ) { return preg_replace_callback( $pattern, function( $matches ) { - return $matches[1] . self::escape_string( $matches[2] ) . $matches[3]; + return $matches[1] . self::escape_text_content( $matches[2] ) . $matches[3]; }, $content ); @@ -125,7 +157,7 @@ function( $matches ) { return preg_replace_callback( $pattern, function( $matches ) { - return 'alt="' . self::escape_string( $matches[1] ) . '"'; + return 'alt="' . self::escape_attribute( $matches[1] ) . '"'; }, $content ); diff --git a/includes/create-theme/theme-patterns.php b/includes/create-theme/theme-patterns.php index e7de4890..23224c2d 100644 --- a/includes/create-theme/theme-patterns.php +++ b/includes/create-theme/theme-patterns.php @@ -38,7 +38,7 @@ public static function escape_alt_for_pattern( $html ) { public static function escape_text_for_pattern( $text ) { if ( $text && trim( $text ) !== '' ) { $escaped_text = addslashes( $text ); - return "get( 'Name' ) . "' ); ?>"; + return "get( 'Name' ) . "');?>"; } } diff --git a/tests/CbtThemeLocale/escapeAttribute.php b/tests/CbtThemeLocale/escapeAttribute.php new file mode 100644 index 00000000..9f511d06 --- /dev/null +++ b/tests/CbtThemeLocale/escapeAttribute.php @@ -0,0 +1,58 @@ +getMethod( $method_name ); + $method->setAccessible( true ); + return $method->invokeArgs( null, $args ); + } + + public function test_escape_attribute() { + $string = 'This is a test attribute.'; + $escaped_string = $this->call_private_method( 'escape_attribute', array( $string ) ); + $expected_string = "get( 'TextDomain' ) . "');?>"; + $this->assertEquals( $expected_string, $escaped_string ); + } + + public function test_escape_attribute_with_single_quote() { + $string = "This is a test attribute with a single quote '"; + $escaped_string = $this->call_private_method( 'escape_attribute', array( $string ) ); + $expected_string = "get( 'TextDomain' ) . "');?>"; + $this->assertEquals( $expected_string, $escaped_string ); + } + + public function test_escape_attribute_with_double_quote() { + $string = 'This is a test attribute with a double quote "'; + $escaped_string = $this->call_private_method( 'escape_attribute', array( $string ) ); + $expected_string = "get( 'TextDomain' ) . "');?>"; + $this->assertEquals( $expected_string, $escaped_string ); + } + + public function test_escape_attribute_with_empty_string() { + $string = ''; + $escaped_string = $this->call_private_method( 'escape_attribute', array( $string ) ); + $this->assertEquals( $string, $escaped_string ); + } + + public function test_escape_attribute_with_already_escaped_string() { + $string = "get( 'TextDomain' ) . "');?>"; + $escaped_string = $this->call_private_method( 'escape_attribute', array( $string ) ); + $this->assertEquals( $string, $escaped_string ); + } + + public function test_escape_attribute_with_non_string() { + $string = null; + $escaped_string = $this->call_private_method( 'escape_attribute', array( $string ) ); + $this->assertEquals( $string, $escaped_string ); + } +} diff --git a/tests/CbtThemeLocale/escapeString.php b/tests/CbtThemeLocale/escapeString.php deleted file mode 100644 index b9ff7361..00000000 --- a/tests/CbtThemeLocale/escapeString.php +++ /dev/null @@ -1,48 +0,0 @@ -assertEquals( "", $escaped_string ); - } - - public function test_escape_string_with_single_quote() { - $string = "This is a test text with a single quote '"; - $escaped_string = CBT_Theme_Locale::escape_string( $string ); - $this->assertEquals( "", $escaped_string ); - } - - public function test_escape_string_with_double_quote() { - $string = 'This is a test text with a double quote "'; - $escaped_string = CBT_Theme_Locale::escape_string( $string ); - $this->assertEquals( "", $escaped_string ); - } - - public function test_escape_string_with_html() { - $string = '

This is a test text with HTML.

'; - $escaped_string = CBT_Theme_Locale::escape_string( $string ); - $this->assertEquals( "This is a test text with HTML.

', 'test-locale-theme');?>", $escaped_string ); - } - - public function test_escape_string_with_already_escaped_string() { - $string = ""; - $escaped_string = CBT_Theme_Locale::escape_string( $string ); - $this->assertEquals( $string, $escaped_string ); - } - - public function test_escape_string_with_non_string() { - $string = null; - $escaped_string = CBT_Theme_Locale::escape_string( $string ); - $this->assertEquals( $string, $escaped_string ); - } -} diff --git a/tests/CbtThemeLocale/escapeTextContent.php b/tests/CbtThemeLocale/escapeTextContent.php new file mode 100644 index 00000000..32609243 --- /dev/null +++ b/tests/CbtThemeLocale/escapeTextContent.php @@ -0,0 +1,56 @@ +getMethod( $method_name ); + $method->setAccessible( true ); + return $method->invokeArgs( null, $args ); + } + + public function test_escape_text_content() { + $string = 'This is a test text.'; + $escaped_string = $this->call_private_method( 'escape_text_content', array( $string ) ); + $this->assertEquals( "", $escaped_string ); + } + + public function test_escape_text_content_with_single_quote() { + $string = "This is a test text with a single quote '"; + $escaped_string = $this->call_private_method( 'escape_text_content', array( $string ) ); + $this->assertEquals( "", $escaped_string ); + } + + public function test_escape_text_content_with_double_quote() { + $string = 'This is a test text with a double quote "'; + $escaped_string = $this->call_private_method( 'escape_text_content', array( $string ) ); + $this->assertEquals( "", $escaped_string ); + } + + public function test_escape_text_content_with_html() { + $string = '

This is a test text with HTML.

'; + $escaped_string = $this->call_private_method( 'escape_text_content', array( $string ) ); + $this->assertEquals( "This is a test text with HTML.

', 'test-locale-theme');?>", $escaped_string ); + } + + public function test_escape_text_content_with_already_escaped_string() { + $string = ""; + $escaped_string = $this->call_private_method( 'escape_text_content', array( $string ) ); + $this->assertEquals( $string, $escaped_string ); + } + + public function test_escape_text_content_with_non_string() { + $string = null; + $escaped_string = $this->call_private_method( 'escape_text_content', array( $string ) ); + $this->assertEquals( $string, $escaped_string ); + } +} diff --git a/tests/CbtThemeLocale/escapeTextContentOfBlocks.php b/tests/CbtThemeLocale/escapeTextContentOfBlocks.php index 7df7b62f..2fee4adf 100644 --- a/tests/CbtThemeLocale/escapeTextContentOfBlocks.php +++ b/tests/CbtThemeLocale/escapeTextContentOfBlocks.php @@ -130,7 +130,7 @@ public function data_test_escape_text_content_of_blocks() { ', 'expected_markup' => ' -
<?php esc_html_e(\'Windows of a building in Nuremberg, Germany\', \'test-locale-theme\');?>
+
<?php esc_attr_e(\'Windows of a building in Nuremberg, Germany\', \'test-locale-theme\');?>
', ), @@ -143,7 +143,7 @@ public function data_test_escape_text_content_of_blocks() { ', 'expected_markup' => ' -
<?php esc_html_e(\'Alternative text for cover image\', \'test-locale-theme\');?>
+
<?php esc_attr_e(\'Alternative text for cover image\', \'test-locale-theme\');?>

', @@ -158,7 +158,7 @@ public function data_test_escape_text_content_of_blocks() { ', 'expected_markup' => ' -
<?php esc_html_e(\'This is alt text\', \'test-locale-theme\');?>
+
<?php esc_attr_e(\'This is alt text\', \'test-locale-theme\');?>

', @@ -189,7 +189,3 @@ public function data_test_escape_text_content_of_blocks() { ); } } - - - - diff --git a/tests/test-theme-templates.php b/tests/test-theme-templates.php index 8ed6f10b..e2842800 100644 --- a/tests/test-theme-templates.php +++ b/tests/test-theme-templates.php @@ -6,7 +6,7 @@ class Test_Create_Block_Theme_Templates extends WP_UnitTestCase { /** - * Ensure that the string in a template is replaced with the appropraite PHP code + * Ensure that the string in a template is replaced with the appropriate PHP code */ public function test_paragraphs_are_localized() { $template = new stdClass(); @@ -16,6 +16,14 @@ public function test_paragraphs_are_localized() { $this->assertStringNotContainsString( '

This is text to localize

', $new_template->content ); } + public function test_empty_paragraphs_are_not_localized() { + $template = new stdClass(); + $template->content = '

'; + $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); + $this->assertStringContainsString( '

', $new_template->content ); + $this->assertStringNotContainsString( 'esc_html_e', $new_template->content ); + } + /** * Ensure that escape_text_in_template is not called when the localizeText flag is set to false */ @@ -37,7 +45,7 @@ public function test_paragraphs_in_groups_are_localized() {
'; $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); - $this->assertStringContainsString( 'This is text to localize', $new_template->content ); + $this->assertStringContainsString( "", $new_template->content ); $this->assertStringNotContainsString( '

This is text to localize

', $new_template->content ); } @@ -49,7 +57,7 @@ public function test_buttons_are_localized() {
'; $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); - $this->assertStringContainsString( 'This is text to localize', $new_template->content ); + $this->assertStringContainsString( "", $new_template->content ); $this->assertStringNotContainsString( 'This is text to localize', $new_template->content ); } @@ -61,7 +69,7 @@ public function test_headings_are_localized() { '; $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); - $this->assertStringContainsString( 'This is a heading to localize.', $new_template->content ); + $this->assertStringContainsString( "", $new_template->content ); $this->assertStringNotContainsString( '

This is a heading to localize.

', $new_template->content ); } @@ -135,8 +143,8 @@ public function test_properly_encode_quotes_and_doublequotes() { '; $escaped_template = CBT_Theme_Templates::escape_text_in_template( $template ); - /* That looks like a mess, but what it should look like for REAL is */ - $this->assertStringContainsString( '', $escaped_template->content ); + /* That looks like a mess, but what it should look like for REAL is */ + $this->assertStringContainsString( "", $escaped_template->content ); } public function test_properly_encode_lessthan_and_greaterthan() { @@ -146,7 +154,7 @@ public function test_properly_encode_lessthan_and_greaterthan() { '; $escaped_template = CBT_Theme_Templates::escape_text_in_template( $template ); - $this->assertStringContainsString( ' is a <test>\', \'\');?>', $escaped_template->content ); + $this->assertStringContainsString( " is a <test>', '');?>", $escaped_template->content ); } public function test_properly_encode_html_markup() { @@ -156,7 +164,18 @@ public function test_properly_encode_html_markup() { '; $escaped_template = CBT_Theme_Templates::escape_text_in_template( $template ); - $this->assertStringContainsString( 'Bold text has feelings <> TOO\', \'\');?>', $escaped_template->content ); + $this->assertStringContainsString( "Bold text has feelings <> TOO', '');?>", $escaped_template->content ); + } + + public function test_empty_alt_text_is_not_localized() { + $template = new stdClass(); + $template->content = ' + +
+ + '; + $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); + $this->assertStringContainsString( 'alt=""', $new_template->content ); } public function test_localize_alt_text_from_image() { @@ -167,7 +186,7 @@ public function test_localize_alt_text_from_image() { '; $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); - $this->assertStringContainsString( 'alt=""', $new_template->content ); + $this->assertStringContainsString( 'alt=""', $new_template->content ); } public function test_localize_alt_text_from_cover() { @@ -187,7 +206,7 @@ public function test_localize_alt_text_from_cover() { '; $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); // Check the markup attribute - $this->assertStringContainsString( 'alt=""', $new_template->content ); + $this->assertStringContainsString( 'alt=""', $new_template->content ); } public function test_localize_quote() { @@ -296,7 +315,7 @@ public function test_localize_media_text() { '; $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); $this->assertStringContainsString( "", $new_template->content ); - $this->assertStringContainsString( "", $new_template->content ); + $this->assertStringContainsString( "", $new_template->content ); } public function test_localize_cover_block_children() { @@ -314,7 +333,7 @@ public function test_localize_cover_block_children() { '; $new_template = CBT_Theme_Templates::escape_text_in_template( $template ); - $this->assertStringContainsString( '

', $new_template->content ); + $this->assertStringContainsString( "

", $new_template->content ); } public function test_localize_nested_cover_block_children() {