]*class="__iawmlf-post-loop-links"[^>]*\bhidden\b/',
+ $rendered,
+ 'The link data span should include the hidden attribute.'
+ );
+
+ unset( $GLOBALS['post'] );
+ }
+
+ /**
+ * @testdox The link data span should be appended after the block content so it does not hijack :first-child CSS rules.
+ *
+ * @return void
+ */
+ public function test_render_block_output_is_appended_after_block_content(): void {
+ $rendered = $this->render_post_with_content( 'Hi a' );
+
+ $content_position = strpos( $rendered, 'href="https://example.com/page"' );
+ $span_position = strpos( $rendered, '__iawmlf-post-loop-links' );
+
+ $this->assertNotFalse( $content_position, 'Block content with the link should be in the rendered output.' );
+ $this->assertNotFalse( $span_position, 'The link data span should be in the rendered output.' );
+ $this->assertGreaterThan( $content_position, $span_position, 'The data span should appear after the block content.' );
+
+ unset( $GLOBALS['post'] );
+ }
+
+ /**
+ * @testdox The link data should be parseable from the DOM via getAttribute, mirroring browser behaviour.
+ *
+ * @return void
+ */
+ public function test_link_data_can_be_decoded_from_dom_document(): void {
+ $rendered = $this->render_post_with_content( 'Hi a' );
+
+ $data = $this->extract_link_data_from_rendered( $rendered );
+
+ $this->assertNotNull( $data );
+ $this->assertIsArray( $data );
+ $this->assertContains( 'https://example.com/page', array_column( $data, 'href' ) );
+
+ unset( $GLOBALS['post'] );
+ }
+
+ /**
+ * @testdox The link data span should survive a single pass of wp_kses_post with the data attribute intact.
+ *
+ * @return void
+ */
+ public function test_link_data_survives_single_wp_kses_post_pass(): void {
+ $rendered = $this->render_post_with_content( 'Hi a' );
+
+ $baseline = $this->extract_link_data_from_rendered( $rendered );
+ $this->assertNotNull( $baseline );
+
+ $kses = wp_kses_post( $rendered );
+ $kses_data = $this->extract_link_data_from_rendered( $kses );
+
+ $this->assertNotNull( $kses_data, 'Span + data should survive a single wp_kses_post pass.' );
+ $this->assertSame( array_column( $baseline, 'href' ), array_column( $kses_data, 'href' ) );
+
+ unset( $GLOBALS['post'] );
+ }
+
+ /**
+ * @testdox The link data span should survive multiple consecutive wp_kses_post passes (some themes wrap content more than once).
+ *
+ * @return void
+ */
+ public function test_link_data_survives_multiple_wp_kses_post_passes(): void {
+ $rendered = $this->render_post_with_content( 'Hi a' );
+
+ $baseline = $this->extract_link_data_from_rendered( $rendered );
+ $this->assertNotNull( $baseline );
+
+ $current = $rendered;
+ for ( $i = 0; $i < 5; $i++ ) {
+ $current = wp_kses_post( $current );
+ }
+
+ $kses_data = $this->extract_link_data_from_rendered( $current );
+
+ $this->assertNotNull( $kses_data, 'Span + data should survive 5 wp_kses_post passes.' );
+ $this->assertSame( array_column( $baseline, 'href' ), array_column( $kses_data, 'href' ) );
+
+ unset( $GLOBALS['post'] );
+ }
+
+ /**
+ * @testdox The link data span should survive the full the_content filter chain followed by wp_kses_post (the case that broke in production).
+ *
+ * @return void
+ */
+ public function test_link_data_survives_the_content_filter_chain(): void {
+ $rendered = $this->render_post_with_content( 'Hi a' );
+
+ $baseline = $this->extract_link_data_from_rendered( $rendered );
+ $this->assertNotNull( $baseline );
+
+ $filtered = apply_filters( 'the_content', $rendered );
+ $kses = wp_kses_post( $filtered );
+
+ $kses_data = $this->extract_link_data_from_rendered( $kses );
+
+ $this->assertNotNull( $kses_data, 'Span + data should survive the_content filter chain + wp_kses_post.' );
+ $this->assertSame( array_column( $baseline, 'href' ), array_column( $kses_data, 'href' ) );
+
+ // Critically: the JSON should not have leaked as visible text in the rendered output.
+ $dom = new \DOMDocument();
+ $prev = libxml_use_internal_errors( true );
+ $dom->loadHTML( '' . $kses . '', LIBXML_NOERROR | LIBXML_NOWARNING );
+ libxml_clear_errors();
+ libxml_use_internal_errors( $prev );
+
+ $body_text = $dom->textContent;
+ $this->assertStringNotContainsString( 'href":', $body_text, 'JSON keys should not appear as visible text in the rendered output.' );
+
+ unset( $GLOBALS['post'] );
+ }
+
+ /**
+ * @testdox The link data span should survive nested wp_kses_post wrapping (the category-template scenario).
+ *
+ * @return void
+ */
+ public function test_link_data_survives_nested_wp_kses_post(): void {
+ $rendered = $this->render_post_with_content( 'Hi a' );
+
+ // Simulate a theme that wraps the rendered output in additional kses.
+ $nested = wp_kses_post( '' . wp_kses_post( $rendered ) . '
' );
+
+ $kses_data = $this->extract_link_data_from_rendered( $nested );
+
+ $this->assertNotNull( $kses_data, 'Span + data should survive nested wp_kses_post wrapping.' );
+ $this->assertNotEmpty( array_column( $kses_data, 'href' ) );
+
+ unset( $GLOBALS['post'] );
+ }
+
+ /**
+ * Data provider: URLs containing characters that historically broke escaping or kses round-trips.
+ *
+ * @return array
+ */
+ public function provide_special_chars_in_urls(): array {
+ return array(
+ 'plain' => array( 'https://example.com/plain' ),
+ 'query_with_ampersand' => array( 'https://example.com/page?a=1&b=2' ),
+ 'percent_encoded_quote' => array( 'https://example.com/page?title=%22hello%22' ),
+ 'percent_encoded_apos' => array( 'https://example.com/page?title=%27hello%27' ),
+ 'unicode_path' => array( 'https://example.com/%E6%97%A5%E6%9C%AC%E8%AA%9E' ),
+ 'emoji_query' => array( 'https://example.com/page?title=%F0%9F%9A%80' ),
+ 'long_url' => array( 'https://example.com/' . str_repeat( 'abc', 100 ) ),
+ );
+ }
+
+ /**
+ * @testdox The link data span should round-trip URLs containing characters that stress JSON encoding and kses.
+ *
+ * @dataProvider provide_special_chars_in_urls
+ *
+ * @param string $href_in_html The href to embed in post content.
+ *
+ * @return void
+ */
+ public function test_link_data_survives_kses_with_special_chars_in_url( string $href_in_html ): void {
+ $content = sprintf( 'Edge case link', esc_url( $href_in_html ) );
+ $rendered = $this->render_post_with_content( $content );
+
+ $baseline = $this->extract_link_data_from_rendered( $rendered );
+ $this->assertNotNull( $baseline, 'Should be able to extract link data from initial render.' );
+ $this->assertNotEmpty( array_column( $baseline, 'href' ) );
+
+ // Run through three kses passes — the kses+attribute path should be lossless regardless of payload.
+ $current = $rendered;
+ for ( $i = 0; $i < 3; $i++ ) {
+ $current = wp_kses_post( $current );
+ }
+
+ $kses_data = $this->extract_link_data_from_rendered( $current );
+
+ $this->assertNotNull( $kses_data, 'Span + data should survive 3 wp_kses_post passes for this payload.' );
+ $this->assertSame(
+ array_column( $baseline, 'href' ),
+ array_column( $kses_data, 'href' ),
+ 'The href set should be byte-identical before and after multiple kses passes.'
+ );
+
+ unset( $GLOBALS['post'] );
+ }
}