assertSame( 'Boom" onmouseover="alert(1) & Co', $escaped );
$this->assertStringNotContainsString( '" onmouseover="', $escaped );
}
public function testHtmlTitleUsesKsesWithoutDoubleEncodingEntities() {
CE_Test_State::$titles[7] = 'A & B
';
$this->assertSame(
CE_KSES_SENTINEL . 'A & B',
ceo_title_for_html( 7 )
);
$this->assertSame(
array( 'A & B' ),
CE_Test_State::$kses_calls
);
}
public function testCastOutputEscapesSlugAttributesAndFiltersVisibleMarkup() {
$character = new stdClass();
$character->slug = 'hero" onclick="alert(1)';
$character->name = 'Hero & Friend';
$character->description = 'Bio';
$character->count = 1;
$output = ceo_cast_display( $character, false, true );
$this->assertStringContainsString( 'character-hero" onclick="alert(1)', $output );
$this->assertStringNotContainsString( 'class="cast-pic character-hero" onclick="', $output );
$this->assertStringContainsString( CE_KSES_SENTINEL . $character->name, $output );
$this->assertStringContainsString( CE_KSES_SENTINEL . $character->description, $output );
}
public function testUnknownCharacterShortcodeEscapesTheReflectedName() {
$output = ceo_cast_page(
array( 'character' => '' )
);
$this->assertStringContainsString( '<img src=x onerror=alert(1)>', $output );
$this->assertStringNotContainsString( ' $message ) );
} finally {
unset( $_REQUEST['action'] );
}
$this->assertStringContainsString( CE_KSES_SENTINEL . $message, $output );
$this->assertContains( $message, CE_Test_State::$kses_calls );
}
}