Skip to content

Tests: Add unit test coverage for wp_kses_allow_pdf_objects() #14666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
shail-mehta wants to merge 2 commits into
base: trunk
Choose a base branch
from
Open

Tests: Add unit test coverage for wp_kses_allow_pdf_objects() #14666

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a14c08e
Tests: Add unit test coverage for _wp_kses_allow_pdf_objects()
shail-mehta Oct 21, 2026
6ae6162
Apply Feedback Changes
shail-mehta Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions tests/phpunit/tests/kses/wpKsesAllowPdfObjects.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
<?php

/**
* Tests for _wp_kses_allow_pdf_objects().
*
* @group kses
*
* @covers ::_wp_kses_allow_pdf_objects
*/
class Tests_Kses_wpKsesAllowPdfObjects extends WP_UnitTestCase {

/**
* @ticket 65819
*/
public function test_rejects_urls_with_query_string() {
$uploads = wp_upload_dir( null, false );

$this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf?download=.pdf' ) );
}

/**
* @ticket 65819
*/
public function test_rejects_urls_with_fragment() {
$uploads = wp_upload_dir( null, false );

$this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.pdf#page=.pdf' ) );
}

/**
* @ticket 65819
*/
public function test_rejects_non_pdf_extension() {
$uploads = wp_upload_dir( null, false );

$this->assertFalse( _wp_kses_allow_pdf_objects( $uploads['url'] . '/file.txt' ) );
}

/**
* @ticket 65819
*/
public function test_rejects_pdf_from_other_host() {
$this->assertFalse( _wp_kses_allow_pdf_objects( 'https://evil.example/file.pdf' ) );

@mukeshpanchal27 mukeshpanchal27 Oct 22, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional: a host-prefix case would lock in the trailing / in the str_starts_with() check. A URL such as https://<uploads host>.evil.example/file.pdf should return false:

$host = wp_parse_url( wp_upload_dir( null, false )['url'], PHP_URL_HOST );

$this->assertFalse( _wp_kses_allow_pdf_objects( 'https://' . $host . '.evil.example/file.pdf' ) );

Also, the PR title says wp_kses_allow_pdf_objects(), but the function is _wp_kses_allow_pdf_objects().

}

/**
* @ticket 65819
*/
public function test_allows_pdf_from_uploads_host() {
$uploads = wp_upload_dir( null, false );
$url = trailingslashit( $uploads['url'] ) . 'document.pdf';

$this->assertTrue( _wp_kses_allow_pdf_objects( $url ) );
}
}
Loading