[shail-mehta]

What

Trac ticket: #65819

Adds unit tests for _wp_kses_allow_pdf_objects() in tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php.

Why

_wp_kses_allow_pdf_objects() has no dedicated unit tests. Adding coverage for this helper fills that gap under #65819.

How

New test class covering:

• rejection of query strings and fragments
• rejection of non-PDF extensions
• rejection of PDFs from other hosts
• acceptance of PDFs under the site uploads URL

Test-only; no production code changes.

Testing Instructions

1. npm run test:php -- --filter Tests_Kses_wpKsesAllowPdfObjects
2. npm run test:php -- --filter Tests_Kses_wpKsesAllowPdfObjects -c tests/phpunit/multisite.xml
3. npm run test:php -- --filter Tests_Kses_wpKsesAllowPdfObjects --order-by=random
4. npm run test:php -- --group kses

Use of AI Tools

• Cursor

[Copilot]

🟡 Changes recommended

The query-string and fragment fixtures need to isolate their intended rejection checks to detect regressions.

1 open issue

• Ensure query and fragment fixtures isolate their intended rejection guards · New

What changed in this PR

Adds dedicated unit tests for _wp_kses_allow_pdf_objects() under Trac #65819, without changing production code.

Changes:

• Tests rejection of query strings, fragments, non-PDF extensions, and other hosts.
• Tests acceptance of PDFs under the site uploads URL.

File	Description
tests/​phpunit/​tests/​kses/​wpKsesAllowPdfObjects.php	Adds five dedicated PDF-object validation tests.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

Static review found the assertions consistent with the helper’s behavior and no blocking issues; tests were not executed.

No open issues 🎉

1 resolved since last review

• Ensure query and fragment fixtures isolate their intended rejection guards

_{Review effort: Balanced}

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props shailu25.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[mukeshpanchal27]

Thanks for the tests. They look correct, and CI passes. One optional suggestion inline.

[mukeshpanchal27]

Optional: a host-prefix case would lock in the trailing / in the str_starts_with() check. A URL such as https://<uploads host>.evil.example/file.pdf should return false:

$host = wp_parse_url( wp_upload_dir( null, false )['url'], PHP_URL_HOST );

$this->assertFalse( _wp_kses_allow_pdf_objects( 'https://' . $host . '.evil.example/file.pdf' ) );

Also, the PR title says wp_kses_allow_pdf_objects(), but the function is _wp_kses_allow_pdf_objects().