Tests: Make Block Bindings unsafe HTML test independent of KSES text handling

tests/phpunit/tests/block-bindings/render.php

@@ -182,19 +182,13 @@ public function test_update_block_with_value_from_source( $bound_attribute, $blo
 
 	public function data_different_get_value_callbacks() {
 		return array(
-			'pass arguments to source'        => array(
+			'pass arguments to source' => array(
 				function ( $source_args, $block_instance, $attribute_name ) {
 					$value = $source_args['key'];
 					return "The attribute name is '$attribute_name' and its binding has argument 'key' with value '$value'.";
 				},
 				"<p class=\"wp-block-paragraph\">The attribute name is 'content' and its binding has argument 'key' with value 'test'.</p>",
 			),
-			'unsafe HTML should be sanitized' => array(
-				function () {
-					return '<script>alert("Unsafe HTML")</script>';
-				},
-				'<p class="wp-block-paragraph"></p>',
-			),
 			'symbols and numbers should be rendered correctly' => array(
 				function () {
 					return '$12.50';
@@ -242,6 +236,38 @@ public function test_different_get_value_callbacks( $get_value_callback, $expect
 		);
 	}
 
+	/**
+	 * Tests that unsafe HTML returned by the source is sanitized.
+	 *
+	 * @ticket 60651
+	 * @ticket 66208
+	 *
+	 * @covers ::register_block_bindings_source
+	 */
+	public function test_unsafe_html_from_source_is_sanitized() {
+		register_block_bindings_source(
+			self::SOURCE_NAME,
+			array(
+				'label'              => self::SOURCE_LABEL,
+				'get_value_callback' => function () {
+					return '<script>alert("Unsafe HTML")</script>';
+				},
+			)
+		);
+
+		$block_content = <<<HTML
+<!-- wp:paragraph {"metadata":{"bindings":{"content":{"source":"test/source"}}}} -->
+<p>This should not appear</p>
+<!-- /wp:paragraph -->
+HTML;
+		$parsed_blocks = parse_blocks( $block_content );
+		$block         = new WP_Block( $parsed_blocks[0] );
+		$result        = $block->render();
+
+		$processor = new WP_HTML_Tag_Processor( $result );
+		$this->assertFalse( $processor->next_tag( 'SCRIPT' ), 'The SCRIPT element should be removed.' );
+	}
+
 	/**
 	 * Tests passing `uses_context` as argument to the source.
 	 *