Changeset 50409

Timestamp:

02/23/2021 01:58:21 AM (4 years ago)

Author:

peterwilsoncc

Message:

Security: move Content-Security-Policy script loaders.

Move wp_get_script_tag(), wp_print_script_tag(), wp_print_inline_script_tag() and wp_get_inline_script_tag() functions from functions.php to script-loader.php.

Relocate related tests to dependencies sub-directory.

Follow up to [50167].
Props adamsilverstein, hellofromTonya, SergeyBiryukov.
Fixes #39941.

Location:

trunk

Files:

• src/wp-includes/functions.php (modified) (1 diff)
• src/wp-includes/script-loader.php (modified) (1 diff)
• tests/phpunit/tests/dependencies/wpInlineScriptTag.php (moved) (moved from trunk/tests/phpunit/tests/functions/wpInlineScriptTag.php) (1 diff)
• tests/phpunit/tests/dependencies/wpSanitizeScriptAttributes.php (moved) (moved from trunk/tests/phpunit/tests/functions/wpSanitizeScriptAttributes.php) (1 diff)
• tests/phpunit/tests/dependencies/wpScriptTag.php (moved) (moved from trunk/tests/phpunit/tests/functions/wpScriptTag.php) (3 diffs)

trunk/src/wp-includes/functions.php

@@ -7867 +7867 @@
     return abs( (float) $expected - (float) $actual ) <= $precision;
 }
-
-/**
- * Sanitizes an attributes array into an attributes string to be placed inside a `<script>` tag.
- *
- * Automatically injects type attribute if needed.
- * Used by {@see wp_get_script_tag()} and {@see wp_get_inline_script_tag()}.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- * @return string String made of sanitized `<script>` tag attributes.
- */
-function wp_sanitize_script_attributes( $attributes ) {
-    $html5_script_support = ! is_admin() && ! current_theme_supports( 'html5', 'script' );
-    $attributes_string    = '';
-
-    // If HTML5 script tag is supported, only the attribute name is added
-    // to $attributes_string for entries with a boolean value, and that are true.
-    foreach ( $attributes as $attribute_name => $attribute_value ) {
-        if ( is_bool( $attribute_value ) ) {
-            if ( $attribute_value ) {
-                $attributes_string .= $html5_script_support ? sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_name ) ) : ' ' . $attribute_name;
-            }
-        } else {
-            $attributes_string .= sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_value ) );
-        }
-    }
-
-    return $attributes_string;
-}
-
-/**
- * Formats `<script>` loader tags.
- *
- * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- * @return string String containing `<script>` opening and closing tags.
- */
-function wp_get_script_tag( $attributes ) {
-    if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
-        $attributes['type'] = 'text/javascript';
-    }
-    /**
-     * Filters attributes to be added to a script tag.
-     *
-     * @since 5.7.0
-     *
-     * @param array $attributes Key-value pairs representing `<script>` tag attributes.
-     *                          Only the attribute name is added to the `<script>` tag for
-     *                          entries with a boolean value, and that are true.
-     */
-    $attributes = apply_filters( 'wp_script_attributes', $attributes );
-
-    return sprintf( "<script%s></script>\n", wp_sanitize_script_attributes( $attributes ) );
-}
-
-/**
- * Prints formatted `<script>` loader tag.
- *
- * It is possible to inject attributes in the `<script>` tag via the  {@see 'wp_script_attributes'}  filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- */
-function wp_print_script_tag( $attributes ) {
-    echo wp_get_script_tag( $attributes );
-}
-
-/**
- * Wraps inline JavaScript in `<script>` tag.
- *
- * It is possible to inject attributes in the `<script>` tag via the  {@see 'wp_script_attributes'}  filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param string $javascript Inline JavaScript code.
- * @param array  $attributes  Optional. Key-value pairs representing `<script>` tag attributes.
- * @return string String containing inline JavaScript code wrapped around `<script>` tag.
- */
-function wp_get_inline_script_tag( $javascript, $attributes = array() ) {
-    if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
-        $attributes['type'] = 'text/javascript';
-    }
-    /**
-     * Filters attributes to be added to a script tag.
-     *
-     * @since 5.7.0
-     *
-     * @param array $attributes Key-value pairs representing `<script>` tag attributes.
-     *                          Only the attribute name is added to the `<script>` tag for
-     *                          entries with a boolean value, and that are true.
-     */
-    $attributes = apply_filters( 'wp_inline_script_attributes', $attributes, $javascript );
-
-    $javascript = "\n" . trim( $javascript, "\n\r " ) . "\n";
-
-    return sprintf( "<script%s>%s</script>\n", wp_sanitize_script_attributes( $attributes ), $javascript );
-}
-
-/**
- * Prints inline JavaScript wrapped in `<script>` tag.
- *
- * It is possible to inject attributes in the `<script>` tag via the  {@see 'wp_script_attributes'}  filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param string $javascript Inline JavaScript code.
- * @param array  $attributes Optional. Key-value pairs representing `<script>` tag attributes.
- */
-function wp_print_inline_script_tag( $javascript, $attributes = array() ) {
-    echo wp_get_inline_script_tag( $javascript, $attributes );
-}

trunk/src/wp-includes/script-loader.php

@@ -2333 +2333 @@
     wp_enqueue_style( 'wp-block-directory' );
 }
+
+/**
+ * Sanitizes an attributes array into an attributes string to be placed inside a `<script>` tag.
+ *
+ * Automatically injects type attribute if needed.
+ * Used by {@see wp_get_script_tag()} and {@see wp_get_inline_script_tag()}.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ * @return string String made of sanitized `<script>` tag attributes.
+ */
+function wp_sanitize_script_attributes( $attributes ) {
+    $html5_script_support = ! is_admin() && ! current_theme_supports( 'html5', 'script' );
+    $attributes_string    = '';
+
+    // If HTML5 script tag is supported, only the attribute name is added
+    // to $attributes_string for entries with a boolean value, and that are true.
+    foreach ( $attributes as $attribute_name => $attribute_value ) {
+        if ( is_bool( $attribute_value ) ) {
+            if ( $attribute_value ) {
+                $attributes_string .= $html5_script_support ? sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_name ) ) : ' ' . $attribute_name;
+            }
+        } else {
+            $attributes_string .= sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_value ) );
+        }
+    }
+
+    return $attributes_string;
+}
+
+/**
+ * Formats `<script>` loader tags.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ * @return string String containing `<script>` opening and closing tags.
+ */
+function wp_get_script_tag( $attributes ) {
+    if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
+        $attributes['type'] = 'text/javascript';
+    }
+    /**
+     * Filters attributes to be added to a script tag.
+     *
+     * @since 5.7.0
+     *
+     * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+     *                          Only the attribute name is added to the `<script>` tag for
+     *                          entries with a boolean value, and that are true.
+     */
+    $attributes = apply_filters( 'wp_script_attributes', $attributes );
+
+    return sprintf( "<script%s></script>\n", wp_sanitize_script_attributes( $attributes ) );
+}
+
+/**
+ * Prints formatted `<script>` loader tag.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the  {@see 'wp_script_attributes'}  filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ */
+function wp_print_script_tag( $attributes ) {
+    echo wp_get_script_tag( $attributes );
+}
+
+/**
+ * Wraps inline JavaScript in `<script>` tag.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the  {@see 'wp_script_attributes'}  filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param string $javascript Inline JavaScript code.
+ * @param array  $attributes  Optional. Key-value pairs representing `<script>` tag attributes.
+ * @return string String containing inline JavaScript code wrapped around `<script>` tag.
+ */
+function wp_get_inline_script_tag( $javascript, $attributes = array() ) {
+    if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
+        $attributes['type'] = 'text/javascript';
+    }
+    /**
+     * Filters attributes to be added to a script tag.
+     *
+     * @since 5.7.0
+     *
+     * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+     *                          Only the attribute name is added to the `<script>` tag for
+     *                          entries with a boolean value, and that are true.
+     */
+    $attributes = apply_filters( 'wp_inline_script_attributes', $attributes, $javascript );
+
+    $javascript = "\n" . trim( $javascript, "\n\r " ) . "\n";
+
+    return sprintf( "<script%s>%s</script>\n", wp_sanitize_script_attributes( $attributes ), $javascript );
+}
+
+/**
+ * Prints inline JavaScript wrapped in `<script>` tag.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the  {@see 'wp_script_attributes'}  filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param string $javascript Inline JavaScript code.
+ * @param array  $attributes Optional. Key-value pairs representing `<script>` tag attributes.
+ */
+function wp_print_inline_script_tag( $javascript, $attributes = array() ) {
+    echo wp_get_inline_script_tag( $javascript, $attributes );
+}

trunk/tests/phpunit/tests/dependencies/wpInlineScriptTag.php

@@ -4 +4 @@
  * Test wp_get_inline_script_tag() and wp_print_inline_script_tag().
  *
- * @group functions.php
+ * @group dependencies
+ * @group scripts
+ * @covers ::wp_get_inline_script_tag
+ * @covers ::wp_print_inline_script_tag
  */
 class Tests_Functions_wpInlineScriptTag extends WP_UnitTestCase {

trunk/tests/phpunit/tests/dependencies/wpSanitizeScriptAttributes.php

@@ -4 +4 @@
  * Test wp_sanitize_script_attributes().
  *
- * @group functions.php
+ * @group dependencies
+ * @group scripts
+ * @covers ::wp_sanitize_script_attributes
  */
 class Tests_Functions_wpSanitizeScriptAttributes extends WP_UnitTestCase {

trunk/tests/phpunit/tests/dependencies/wpScriptTag.php

@@ -4 +4 @@
  * Test wp_get_script_tag() and wp_print_script_tag().
  *
- * @group functions.php
+ * @group dependencies
+ * @group scripts
  */
 class Tests_Functions_wpScriptTag extends WP_UnitTestCase {
@@ -38 +39 @@
     }
 
+    /**
+     * @covers ::wp_get_script_tag
+     */
     function test_get_script_tag_type_not_set() {
         add_theme_support( 'html5', array( 'script' ) );
@@ -55 +59 @@
     }
 
+    /**
+     * @covers ::wp_print_script_tag
+     */
     function test_print_script_tag_prints_get_script_tag() {
         add_filter(