image',
+ 'file' => 'image.jpg',
+ 'post_mime_type' => 'image/jpeg',
+ )
+ );
+
+ $GLOBALS['post'] = $attachment;
+
+ $handle_row_actions = new ReflectionMethod( self::$list_table, 'handle_row_actions' );
+ if ( PHP_VERSION_ID < 80100 ) {
+ $handle_row_actions->setAccessible( true );
+ }
+ $output = $handle_row_actions->invoke( self::$list_table, $attachment, 'title', 'title' );
+ if ( PHP_VERSION_ID < 80100 ) {
+ $handle_row_actions->setAccessible( false );
+ }
+
+ unset( $GLOBALS['post'] );
+
+ $this->assertStringNotContainsString( '<div>', $output, 'The escaped HTML was not stripped from the title.' );
+ $this->assertStringContainsString( 'aria-label="Edit “myimage”"', $output, 'The "edit" aria-label did not contain the stripped title.' );
+ }
+
/**
* Sets the `$is_trash` property.
*
diff --git a/tests/phpunit/tests/admin/wpPostsListTable.php b/tests/phpunit/tests/admin/wpPostsListTable.php
index 25324dcb4cb7f..757c605be362c 100644
--- a/tests/phpunit/tests/admin/wpPostsListTable.php
+++ b/tests/phpunit/tests/admin/wpPostsListTable.php
@@ -596,4 +596,44 @@ public function test_checkbox_label_includes_no_title_excerpt() {
$this->assertStringContainsString( 'Select (no title) Hello world example excerpt.', $output );
}
+
+ /**
+ * Tests that `WP_Posts_List_Table::handle_row_actions()` strips HTML from the
+ * post title used within the row action `aria-label` attributes.
+ *
+ * The title is escaped by `_draft_or_post_title()`, so any HTML it contains
+ * survives `esc_attr()` and is announced as literal text by screen readers.
+ *
+ * @ticket 65729
+ *
+ * @covers WP_Posts_List_Table::handle_row_actions
+ */
+ public function test_handle_row_actions_should_strip_html_from_aria_labels() {
+ wp_set_current_user( self::factory()->user->create( array( 'role' => 'administrator' ) ) );
+
+ $post = self::factory()->post->create_and_get(
+ array(
+ 'post_title' => 'my
post',
+ 'post_status' => 'publish',
+ )
+ );
+
+ $GLOBALS['post'] = $post;
+
+ $table = _get_list_table( 'WP_Posts_List_Table', array( 'screen' => 'edit-post' ) );
+
+ $handle_row_actions = new ReflectionMethod( $table, 'handle_row_actions' );
+ if ( PHP_VERSION_ID < 80100 ) {
+ $handle_row_actions->setAccessible( true );
+ }
+ $output = $handle_row_actions->invoke( $table, $post, 'title', 'title' );
+ if ( PHP_VERSION_ID < 80100 ) {
+ $handle_row_actions->setAccessible( false );
+ }
+
+ unset( $GLOBALS['post'] );
+
+ $this->assertStringNotContainsString( '<div>', $output, 'The escaped HTML was not stripped from the title.' );
+ $this->assertStringContainsString( 'aria-label="Edit “mypost”"', $output, 'The "edit" aria-label did not contain the stripped title.' );
+ }
}