Tests: Run block fixtures through KSES.

[pento]

Description

#34738 noted that the PDF embed feature produces HTML that KSES strips for non-admin users.

In order to help avoid this in the future, we should run block fixtures through KSES, to ensure they produce HTML that won't be stripped when a post is saved.

Note: This PR requires WP54261 in order to pass.

How has this been tested?

This change only affects PHP unit tests, and modifies some of the fixtures that inadvertently have data stripped, due to using HTML that KSES doesn't allow.

Checklist:

• My code is tested.
• My code follows the WordPress code style.
• My code follows the accessibility standards.
• I've tested my changes with keyboard and screen readers.
• My code has proper inline documentation.
• I've included developer documentation if appropriate.
• I've updated all React Native files affected by any refactorings/renamings in this PR (please manually search all *.native.js files for terms that need renaming or removal).

[gziolo]

Is KSES removing all images encoded as data? Do we ever inline images in the block editor? Is that a concern?

Other than that, it looks like a nice addition to the verification process 👍

[pento]

Is KSES removing all images encoded as data? Do we ever inline images in the block editor? Is that a concern?

The data: "protocol" has never been allowed in Core, KSES strips it off. I'm fine with assuming that this is just how some of the tests were set up originally, then the rest are a product of copy/pasta. I also had a quick search through the block editor source, I didn't find any concerning references to data:.

If the block editor was storing inline images, we probably would've heard about it by now. (I'm looking forward to this comment coming back to bite me in the future. 😛)

[gziolo]

If the block editor was storing inline images, we probably would've heard about it by now. (I'm looking forward to this comment coming back to bite me in the future. 😛)

I know that the block editor uses data: to show images when uploading/processing them, then replaces that with the final URL. I guess it’s fine to use URL with tests, but it still would be good to clarify why data version infected all those fixtures 😅

[pento]

I know that the block editor uses data: to show images when uploading/processing them, then replaces that with the final URL. I guess it’s fine to use URL with tests, but it still would be good to clarify why data version infected all those fixtures 😅

Ugh, we probably need to figure out a different way to do it, the data: URLs were added on purpose in #14625.

[gziolo]

Ugh, we probably need to figure out a different way to do it, the data: URLs were added on purpose in #14625.

Those fixtures are no longer used with e2e tests so it might be no longer a limitation. The other option could be to run another rule in test_kses_doesnt_change_fixtures that replaces data: with some fake URLs.

[pento]

@gziolo: Good idea on doing the replace in test_kses_doesnt_change_fixtures(), makes for much less churn. 🙂

Since WP54261 has landed, the tests all pass correctly now.

[gziolo]

Great, let's move forward with this PR. We could add a similar test case in WordPress core, but we don't have the same test fixtures there. Maybe, it's enough to have full coverage in the plugin since we sync the code from here anyway.

[pento]

We could add a similar test case in WordPress core, but we don't have the same test fixtures there. Maybe, it's enough to have full coverage in the plugin since we sync the code from here anyway.

I think coverage in the plugin is fine, as long as there's a process to ensure that simple changes to KSES that can be done in the plugin (eg, adding a new tag or attribute through the wp_kses_allowed_html filter) make their way to Core.