Merge pull request #843 from Automattic/fix/842-action-reference-elements

Author: chubes4

php-transformer/src/WordPressSitePlan/WordPressSitePlan.php

@@ -1026,6 +1026,7 @@ private static function assertNoLocalBrowserReferences(string $content, string $
         foreach (self::htmlMarkupNodes($content) as $node) {
             if ('tag' === $node['kind']) foreach ($node['attributes'] as $name => $value) {
                 if (!in_array($name, array('xlink:href', 'srcset', 'src', 'href', 'poster', 'action', 'style'), true)) continue;
+                if ('action' === $name && 'form' !== $node['name']) continue;
                 if ('style' === $name) { $assertCss($value, 'style_attribute'); continue; }
                 foreach ('srcset' === $name ? self::srcsetCandidates($value) : array($value) as $candidate) $assertReference($candidate, $name, $node['name']);
             }
@@ -1035,7 +1036,12 @@ private static function assertNoLocalBrowserReferences(string $content, string $
                 if (is_array($attributes)) {
                     $assertJsonAttributes($attributes, self::jsonUrlIsRoute($node['content']));
                 } elseif (preg_match_all('~(?:"|\\\\u0022)(url|src|href|poster|action|srcset)(?:"|\\\\u0022)\s*:\s*(?:"|\\\\u0022)(.*?)(?:"|\\\\u0022)~is', $node['content'], $fields, PREG_SET_ORDER)) {
-                    foreach ($fields as $field) foreach ('srcset' === strtolower($field[1]) ? self::srcsetCandidates($field[2]) : array($field[2]) as $candidate) $assertReference((string) $candidate, 'json:' . strtolower($field[1]));
+                    $route = self::jsonUrlIsRoute($node['content']);
+                    foreach ($fields as $field) {
+                        $name = strtolower($field[1]);
+                        $routeField = $route && 'url' === $name ? 'route_url' : (in_array($name, array('href', 'action'), true) ? 'route_' . $name : $name);
+                        foreach ('srcset' === $name ? self::srcsetCandidates($field[2]) : array($field[2]) as $candidate) $assertReference(str_replace('\\/', '/', (string) $candidate), 'json:' . $routeField);
+                    }
                 }
             }
         }

php-transformer/tests/contract/wordpress-site-plan.php

@@ -622,6 +622,12 @@
 WordPressSitePlan::assertValid($duplicateExternalFirst); $assert(true, 'Validation ignores later duplicate browser attribute values.');
 $formAction = $plan; $formAction['pages'][0]['canonical_block_markup'] .= '<form action="back"><button>Back</button></form>'; $formAction['pages'][0]['content_hash'] = WordPressSitePlan::contentHash($formAction['pages'][0]['canonical_block_markup']);
 $throws(static fn() => WordPressSitePlan::assertValid($formAction), 'Validation rejects unresolved local form action references.');
+$customAction = $plan; $customAction['pages'][0]['canonical_block_markup'] .= '<fb:like action="like"></fb:like>'; $customAction['pages'][0]['content_hash'] = WordPressSitePlan::contentHash($customAction['pages'][0]['canonical_block_markup']);
+WordPressSitePlan::assertValid($customAction); $assert(true, 'Validation ignores non-URL action metadata on custom elements.');
+$escapedRootReference = $plan; $escapedRootReference['pages'][0]['canonical_block_markup'] .= '<!-- wp:html {\u0022href\u0022:\u0022\/2\/post\/example.html\u0022} /-->'; $escapedRootReference['pages'][0]['content_hash'] = WordPressSitePlan::contentHash($escapedRootReference['pages'][0]['canonical_block_markup']);
+WordPressSitePlan::assertValid($escapedRootReference); $assert(true, 'Fallback block-comment validation decodes escaped root-relative references.');
+$escapedLocalReference = $plan; $escapedLocalReference['pages'][0]['canonical_block_markup'] .= '<!-- wp:html {\u0022href\u0022:\u0022images\/missing.svg\u0022} /-->'; $escapedLocalReference['pages'][0]['content_hash'] = WordPressSitePlan::contentHash($escapedLocalReference['pages'][0]['canonical_block_markup']);
+$throws(static fn() => WordPressSitePlan::assertValid($escapedLocalReference), 'Fallback block-comment validation rejects escaped unresolved local references.');
 $semanticAction = $plan; $semanticAction['pages'][0]['canonical_block_markup'] .= '<div data-options="{&quot;action&quot;:&quot;message&quot;}"></div>'; $semanticAction['pages'][0]['content_hash'] = WordPressSitePlan::contentHash($semanticAction['pages'][0]['canonical_block_markup']);
 WordPressSitePlan::assertValid($semanticAction); $assert(true, 'Validation does not classify semantic JSON action values as browser references.');
 $embeddedIframe = $plan; $embeddedIframe['pages'][0]['canonical_block_markup'] .= '<div data-html="&lt;iframe src=&quot;https://www.youtube.com/embed/hs5KoEYi0R8?feature=oembed&quot;&gt;&lt;/iframe&gt;"></div>'; $embeddedIframe['pages'][0]['content_hash'] = WordPressSitePlan::contentHash($embeddedIframe['pages'][0]['canonical_block_markup']);