assertSame($expected, notes_safe_html($input)); } public static function preservedProvider(): array { return [ 'paragraph' => ['

hello

', '

hello

'], 'nested inline' => [ '

bold both

', '

bold both

', ], 'list' => ['', ''], 'heading' => ['

Title

', '

Title

'], 'blockquote' => ['
quoted
', '
quoted
'], 'legacy table' => [ '
c1
', '
c1
', ], 'plain text' => ['just words', 'just words'], // Legacy notes contain smart quotes and em dashes; libxml defaults to // ISO-8859-1 and would mangle them without an explicit UTF-8 meta. 'utf8 preserved' => [ "

caf\u{00e9} \u{2014} \u{201c}quoted\u{201d} \u{65e5}\u{672c}\u{8a9e}

", "

caf\u{00e9} \u{2014} \u{201c}quoted\u{201d} \u{65e5}\u{672c}\u{8a9e}

", ], ]; } public function testKeepsSafeLinkAndHardensIt(): void { $out = notes_safe_html('AO-8308'); $this->assertStringContainsString('href="https://admedia-jira.atlassian.net/browse/AO-8308"', $out); $this->assertStringContainsString('target="_blank"', $out); $this->assertStringContainsString('rel="noopener noreferrer"', $out); } public function testKeepsMailtoLink(): void { $this->assertStringContainsString('href="mailto:a@b.com"', notes_safe_html('mail')); } /** An unknown wrapper loses the tag but must not lose the words. */ public function testUnwrapsDisallowedTagButKeepsText(): void { $this->assertSame('keep these words', notes_safe_html('
keep these words
')); } // ── What must not survive ──────────────────────────────────────────────── /** @dataProvider strippedProvider */ public function testStripsDangerousMarkup(string $input, array $mustNotContain): void { $out = notes_safe_html($input); foreach ($mustNotContain as $needle) { $this->assertStringNotContainsString($needle, $out, sprintf('%s survived sanitizing', $needle)); } } public static function strippedProvider(): array { return [ // Script text is not content — unwrapping would paste alert(1) into the // page as visible text and re-arm it on any later re-parse. 'script tag' => ['

hi

', [' ['ok', [' ['bad', ['onerror', ' ['

t

', ['style=', 'class=']], 'onclick on p' => ['

t

', ['onclick']], 'javascript href' => ['c', ['javascript']], // "java\nscript:" parses as a path, not a scheme, but browsers honour it. 'obfuscated href' => ["c", ['javascript', "java\nscript"]], 'data href' => ['c', ['data:']], 'protocol rel' => ['c', ['evil.com']], 'iframe' => ['ok', [' ['ok', [' ['

a

', ['alert(1)', '