From a14c08e20d5f1c354b2f42b34a9831556d498807 Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Wed, 21 Oct 2026 23:08:03 +0530 Subject: [PATCH 1/2] Tests: Add unit test coverage for _wp_kses_allow_pdf_objects() --- .../tests/kses/wpKsesAllowPdfObjects.php | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php diff --git a/tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php b/tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php new file mode 100644 index 0000000000000..5b8f88a36be6f --- /dev/null +++ b/tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php @@ -0,0 +1,55 @@ +assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf?download=1' ) ); + } + + /** + * @ticket 65819 + */ + public function test_rejects_urls_with_fragment() { + $uploads = wp_upload_dir( null, false ); + + $this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf#page=1' ) ); + } + + /** + * @ticket 65819 + */ + public function test_rejects_non_pdf_extension() { + $uploads = wp_upload_dir( null, false ); + + $this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.txt' ) ); + } + + /** + * @ticket 65819 + */ + public function test_rejects_pdf_from_other_host() { + $this->assertFalse( _wp_kses_allow_pdf_objects( 'https://evil.example/file.pdf' ) ); + } + + /** + * @ticket 65819 + */ + public function test_allows_pdf_from_uploads_host() { + $uploads = wp_upload_dir( null, false ); + $url = trailingslashit( $uploads['url'] ) . 'document.pdf'; + + $this->assertTrue( _wp_kses_allow_pdf_objects( $url ) ); + } +} From 6ae61621db2c315b261f44ffdff5e7d65914400b Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Wed, 21 Oct 2026 23:14:02 +0530 Subject: [PATCH 2/2] Apply Feedback Changes Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php b/tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php index 5b8f88a36be6f..0df0ac3fa2e59 100644 --- a/tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php +++ b/tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php @@ -15,7 +15,7 @@ class Tests_Kses_wpKsesAllowPdfObjects extends WP_UnitTestCase { public function test_rejects_urls_with_query_string() { $uploads = wp_upload_dir( null, false ); - $this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf?download=1' ) ); + $this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf?download=.pdf' ) ); } /** @@ -24,7 +24,7 @@ public function test_rejects_urls_with_query_string() { public function test_rejects_urls_with_fragment() { $uploads = wp_upload_dir( null, false ); - $this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf#page=1' ) ); + $this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf#page=.pdf' ) ); } /**