" );
+
+ $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' );
+ $this->assertTrue( $processor->set_attribute( "da\u{FFFD}ta", 'new' ), 'Should have set the attribute.' );
+ $this->assertSame( "
", $processor->get_updated_html() );
+ }
+
+ /**
+ * Ensures tag names containing NULL bytes are exposed with U+FFFD,
+ * matching the tokenizer's tag-name-state replacement in browsers.
+ *
+ * @ticket 65372
+ *
+ * @covers ::get_tag
+ * @covers ::get_token_name
+ */
+ public function test_get_tag_replaces_null_bytes(): void {
+ $processor = new WP_HTML_Tag_Processor( "
x" );
+
+ $this->assertTrue( $processor->next_token(), 'Should have found the tag opener.' );
+ $this->assertSame( "DI\u{FFFD}V", $processor->get_tag() );
+ $this->assertSame( "DI\u{FFFD}V", $processor->get_token_name() );
+
+ $this->assertTrue( $processor->next_token(), 'Should have found the text node.' );
+ $this->assertSame( 'x', $processor->get_modifiable_text() );
+
+ $this->assertTrue( $processor->next_token(), 'Should have found the tag closer.' );
+ $this->assertTrue( $processor->is_tag_closer(), 'Should have matched the tag closer.' );
+ $this->assertSame( "DI\u{FFFD}V", $processor->get_tag() );
+ }
+
+ /**
+ * Ensures NULL bytes in tag names do not affect special-element detection:
+ * `
` is not SCRIPT and does not switch into rawtext parsing,
+ * in browsers or here. Internal identification uses raw bytes.
+ *
+ * @ticket 65372
+ *
+ * @covers ::get_tag
+ */
+ public function test_null_byte_in_tag_name_does_not_select_rawtext_parsing(): void {
+ $processor = new WP_HTML_Tag_Processor( "" );
+
+ $this->assertTrue( $processor->next_token(), 'Should have found the tag opener.' );
+ $this->assertSame( "SCR\u{FFFD}IPT", $processor->get_tag() );
+
+ $this->assertTrue( $processor->next_token(), 'Should have found the B tag, not raw text.' );
+ $this->assertSame( 'B', $processor->get_tag() );
+ }
+
+ /**
+ * Ensures NULL bytes cannot appear in PI-lookalike comment tag names,
+ * whose targets are restricted to ASCII name characters.
+ *
+ * @ticket 65372
+ *
+ * @covers ::get_tag
+ */
+ public function test_pi_lookalike_target_stops_before_null_byte(): void {
+ $processor = new WP_HTML_Tag_Processor( "" );
+
+ $this->assertTrue( $processor->next_token(), 'Should have found the comment.' );
+ $this->assertSame( WP_HTML_Tag_Processor::COMMENT_AS_PI_NODE_LOOKALIKE, $processor->get_comment_type() );
+ $this->assertSame( 'px', $processor->get_tag() );
+ }
+
+ /**
+ * Ensures tag-name queries match in the same replaced alphabet that
+ * `get_tag()` exposes: a sought name containing U+FFFD matches source
+ * names whose raw bytes contain NULL in its place, a sought name
+ * containing a raw NULL byte matches nothing, and the value returned
+ * by `get_tag()` round-trips into a successful query.
+ *
+ * This is also how WP_HTML_Processor::next_tag() matches, since it
+ * compares sought names against the token name.
+ *
+ * @ticket 65372
+ *
+ * @covers ::next_tag
+ */
+ public function test_tag_name_queries_match_replaced_names(): void {
+ $processor = new WP_HTML_Tag_Processor( "" );
+ $this->assertTrue( $processor->next_tag( "DI\u{FFFD}V" ), 'Should have matched the tag by its replaced name.' );
+
+ $processor = new WP_HTML_Tag_Processor( "" );
+ $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' );
+ $tag_name = $processor->get_tag();
+ $processor = new WP_HTML_Tag_Processor( "" );
+ $this->assertTrue( $processor->next_tag( array( 'tag_name' => $tag_name ) ), 'The name returned by get_tag() should match in a query.' );
+
+ $processor = new WP_HTML_Tag_Processor( "" );
+ $this->assertFalse( $processor->next_tag( "DI\x00V" ), 'Should not have matched the tag by its raw source name.' );
+
+ $processor = new WP_HTML_Tag_Processor( "" );
+ $this->assertTrue( $processor->next_tag( "DI\u{FFFD}V" ), 'Should have matched a raw U+FFFD name.' );
+
+ $processor = WP_HTML_Processor::create_full_parser( "" );
+ $this->assertTrue( $processor->next_tag( array( 'tag_name' => "DI\u{FFFD}V" ) ), 'The HTML Processor should match the replaced name.' );
+
+ $processor = WP_HTML_Processor::create_full_parser( "" );
+ $this->assertFalse( $processor->next_tag( array( 'tag_name' => "DI\x00V" ) ), 'The HTML Processor should not match the raw source name.' );
+ }
+
+ /**
+ * Ensures class_list does not replace NULL bytes in API-supplied values.
+ *
+ * Browser-verified: `setAttribute('class', "a\x00b")` then reading
+ * `classList` yields the token "a\x00b" with the NULL byte preserved;
+ * U+0000 replacement happens only in the tokenizer, and values from the
+ * input document already receive it through `get_attribute()`.
+ *
+ * @ticket 65372
+ *
+ * @covers ::class_list
+ * @covers ::has_class
+ */
+ public function test_class_list_preserves_null_bytes_in_enqueued_values(): void {
+ $processor = new WP_HTML_Tag_Processor( '' );
+
+ $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' );
+ $this->assertTrue( $processor->set_attribute( 'class', "a\x00b c\u{FFFD}d" ), 'Should have set the class attribute.' );
+ $this->assertSame( array( "a\x00b", "c\u{FFFD}d" ), iterator_to_array( $processor->class_list(), false ), 'Should have preserved the NULL byte in the API-supplied class.' );
+ $this->assertTrue( $processor->has_class( "a\x00b" ) );
+ }
+
+ /**
+ * Ensures the class helpers operate on the replaced source value:
+ * a class containing a NULL byte in the document is exposed, matched,
+ * and queried by its U+FFFD spelling only.
+ *
+ * @ticket 65372
+ *
+ * @covers ::class_list
+ * @covers ::has_class
+ * @covers ::next_tag
+ */
+ public function test_class_helpers_use_replaced_source_values(): void {
+ $processor = new WP_HTML_Tag_Processor( "
" );
+
+ $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' );
+ $this->assertSame( array( "a\u{FFFD}b" ), iterator_to_array( $processor->class_list(), false ), 'Should have exposed the replaced class name.' );
+ $this->assertTrue( $processor->has_class( "a\u{FFFD}b" ), 'Should have matched the replaced class name.' );
+ $this->assertFalse( $processor->has_class( "a\x00b" ), 'Should not have matched the raw source class name.' );
+
+ $processor = new WP_HTML_Tag_Processor( "
" );
+ $this->assertTrue( $processor->next_tag( array( 'class_name' => "a\u{FFFD}b" ) ), 'Should have matched a class_name query by the replaced name.' );
+ }
+
+ /**
+ * Ensures boolean attributes whose names contain NULL bytes are
+ * addressable by their replaced name.
+ *
+ * @ticket 65372
+ *
+ * @covers ::get_attribute
+ */
+ public function test_boolean_attribute_with_null_byte_in_name(): void {
+ $processor = new WP_HTML_Tag_Processor( "
" );
+
+ $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' );
+ $this->assertTrue( $processor->get_attribute( "da\u{FFFD}ta" ), 'Should have reported the boolean attribute by its replaced name.' );
+ }
+
+ /**
+ * Ensures attribute-name prefixes are matched verbatim against the
+ * replaced names: a prefix spelled with U+FFFD matches, and a prefix
+ * containing a raw NULL byte matches nothing.
+ *
+ * @ticket 65372
+ *
+ * @covers ::get_attribute_names_with_prefix
+ */
+ public function test_attribute_name_prefixes_match_replaced_names(): void {
+ $processor = new WP_HTML_Tag_Processor( "
" );
+
+ $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' );
+ $this->assertSame( array( "da\u{FFFD}ta" ), $processor->get_attribute_names_with_prefix( "da\u{FFFD}" ), 'A replaced-name prefix should match.' );
+ $this->assertSame( array(), $processor->get_attribute_names_with_prefix( "da\x00" ), 'A raw NULL prefix should match nothing.' );
+ }
+
+ /**
+ * Ensures the replaced tag names flow through HTML Processor tree
+ * construction: an end tag spelled with U+FFFD closes an element
+ * whose start tag was spelled with a raw NULL byte, as in browsers,
+ * where both spellings tokenize to the same name.
+ *
+ * @ticket 65372
+ */
+ public function test_html_processor_matches_end_tags_across_null_byte_spellings(): void {
+ $this->assertSame(
+ "
xy",
+ WP_HTML_Processor::normalize( "
xy" ),
+ 'The U+FFFD-spelled end tag should have closed the NULL-spelled element.'
+ );
+
+ $processor = WP_HTML_Processor::create_full_parser( "xy" );
+ $this->assertTrue( $processor->next_tag( array( 'tag_name' => "DI\u{FFFD}V" ) ), 'Should have found the element by its replaced name.' );
+ $this->assertSame( array( 'HTML', 'BODY', "DI\u{FFFD}V" ), $processor->get_breadcrumbs(), 'Should have built breadcrumbs from replaced names.' );
+ }
+
+ /**
+ * Ensures pending class updates are flushed for any case spelling of
+ * the "class" attribute name, since attribute names are matched
+ * ASCII-case-insensitively.
+ *
+ * @ticket 65372
+ *
+ * @covers ::get_attribute
+ */
+ public function test_get_attribute_flushes_class_updates_case_insensitively(): void {
+ $processor = new WP_HTML_Tag_Processor( '' );
+
+ $this->assertTrue( $processor->next_tag(), 'Should have found the tag.' );
+ $this->assertTrue( $processor->add_class( 'b' ), 'Should have enqueued the class addition.' );
+ $this->assertSame( 'a b', $processor->get_attribute( 'CLASS' ), 'Should have included pending class updates for an uppercase lookup.' );
+ }
+
+ /**
+ * Ensures numeric character references for U+0000 decode to U+FFFD in text.
+ *
+ * @ticket 65372
+ *
+ * @covers ::get_modifiable_text
+ */
+ public function test_encoded_null_in_text_node_decodes_to_replacement_character(): void {
+ $processor = new WP_HTML_Tag_Processor( 'a�b' );
+
+ $this->assertTrue( $processor->next_token(), 'Should have found the text node.' );
+ $this->assertSame( "a\u{FFFD}b", $processor->get_modifiable_text() );
+ }
+}