assertSame( $stored, esc_textarea( ceo_meta_for_editor( $stored ) ) );
}
/** And the value the author actually typed is what they see again. */
#[DataProvider( 'authoredTextProvider' )]
public function testTheAuthorSeesWhatTheyTyped( $typed ) {
$this->assertSame( $typed, ceo_meta_for_editor( esc_textarea( $typed ) ) );
}
public static function authoredTextProvider() {
return array(
'markup' => array( 'bold' ),
'an entity typed literally' => array( '<b>' ),
'a bare ampersand' => array( 'Tom & Jerry' ),
'quotes' => array( 'she said "hi"' ),
'an apostrophe' => array( "it's fine" ),
'a url with a query string' => array( 'https://x.test/?a=1&b=2' ),
);
}
/**
* A raw value written past the meta boxes must not survive as live markup once the sink
* escapes it. This is the Custom Fields path.
*/
public function testRawMarkupFromCustomFieldsBecomesInert() {
$raw = '';
$out = esc_textarea( ceo_meta_for_editor( $raw ) );
$this->assertStringNotContainsString( '', $out );
$this->assertStringNotContainsString( 'assertSame( $expected, ceo_meta_for_editor( $stored ) );
}
public static function decodingProvider() {
return array(
array( '<b>', '' ),
array( '&', '&' ),
array( '"x"', '"x"' ),
array( ''', "'" ),
array( '', '' ),
array( '¬anentity;', '¬anentity;' ),
);
}
#[DataProvider( 'nonStringProvider' )]
public function testNonStringInputIsHandled( $input, $expected ) {
$this->assertSame( $expected, ceo_meta_for_editor( $input ) );
}
public static function nonStringProvider() {
return array(
array( null, '' ),
array( false, '' ),
array( 123, '123' ),
);
}
}