From ed9c42eef5b455679bf9507d07317e2ab2c95763 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Thu, 8 Oct 2026 09:24:34 +0400
Subject: [PATCH] Tests: Make Block Bindings unsafe HTML test independent of
 KSES text handling.

Moves the unsafe HTML case out of `data_different_get_value_callbacks()` into its own test, which asserts that the rendered block contains no SCRIPT element instead of comparing the exact output. The exact output depends on whether KSES keeps or removes the text inside a removed SCRIPT element, which changed in [64233].

See #66208.
---
 tests/phpunit/tests/block-bindings/render.php | 40 +++++++++++++++----
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/tests/phpunit/tests/block-bindings/render.php b/tests/phpunit/tests/block-bindings/render.php
index 196db4f2b8386..32886a838c705 100644
--- a/tests/phpunit/tests/block-bindings/render.php
+++ b/tests/phpunit/tests/block-bindings/render.php
@@ -182,19 +182,13 @@ public function test_update_block_with_value_from_source( $bound_attribute, $blo
 
 	public function data_different_get_value_callbacks() {
 		return array(
-			'pass arguments to source'        => array(
+			'pass arguments to source' => array(
 				function ( $source_args, $block_instance, $attribute_name ) {
 					$value = $source_args['key'];
 					return "The attribute name is '$attribute_name' and its binding has argument 'key' with value '$value'.";
 				},
 				"<p class=\"wp-block-paragraph\">The attribute name is 'content' and its binding has argument 'key' with value 'test'.</p>",
 			),
-			'unsafe HTML should be sanitized' => array(
-				function () {
-					return '<script>alert("Unsafe HTML")</script>';
-				},
-				'<p class="wp-block-paragraph"></p>',
-			),
 			'symbols and numbers should be rendered correctly' => array(
 				function () {
 					return '$12.50';
@@ -242,6 +236,38 @@ public function test_different_get_value_callbacks( $get_value_callback, $expect
 		);
 	}
 
+	/**
+	 * Tests that unsafe HTML returned by the source is sanitized.
+	 *
+	 * @ticket 60651
+	 * @ticket 66208
+	 *
+	 * @covers ::register_block_bindings_source
+	 */
+	public function test_unsafe_html_from_source_is_sanitized() {
+		register_block_bindings_source(
+			self::SOURCE_NAME,
+			array(
+				'label'              => self::SOURCE_LABEL,
+				'get_value_callback' => function () {
+					return '<script>alert("Unsafe HTML")</script>';
+				},
+			)
+		);
+
+		$block_content = <<<HTML
+<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/source"}}}} -->
+<p>This should not appear</p>
+<!-- /wp:paragraph -->
+HTML;
+		$parsed_blocks = parse_blocks( $block_content );
+		$block         = new WP_Block( $parsed_blocks[0] );
+		$result        = $block->render();
+
+		$processor = new WP_HTML_Tag_Processor( $result );
+		$this->assertFalse( $processor->next_tag( 'SCRIPT' ), 'The SCRIPT element should be removed.' );
+	}
+
 	/**
 	 * Tests passing `uses_context` as argument to the source.
 	 *