Changeset 56687

Timestamp:

09/25/2023 09:03:19 PM (7 months ago)

Author:

westonruter

Message:

Script Loader: Use wp_get_script_tag() and wp_get_inline_script_tag()/wp_print_inline_script_tag() helper functions to output scripts on the frontend and login screen.

Using script tag helper functions allows plugins to employ the wp_script_attributes and wp_inline_script_attributes filters to inject the nonce attribute to apply Content Security Policy (e.g. Strict CSP). Use of helper functions also simplifies logic in WP_Scripts.

• Update wp_get_inline_script_tag() to wrap inline script in CDATA blocks for XHTML-compatibility when not using HTML5.
• Ensure the type attribute is printed first in wp_get_inline_script_tag() for back-compat.
• Wrap existing <script> tags in output buffering to retain IDE supports.
• In wp_get_inline_script_tag(), append the newline to $javascript before it is passed into the wp_inline_script_attributes filter so that the CSP hash can be computed properly.
• In the_block_template_skip_link(), opt to enqueue the inline script rather than print it.
• Add ext-php to composer.json under suggest as previously it was an undeclared dependency for running PHPUnit tests.
• Update tests to rely on DOMDocument to compare script markup, normalizing unsemantic differences.

Props westonruter, spacedmonkey, flixos90, 10upsimon, dmsnell, mukesh27, joemcgill, swissspidy, azaozz.
Fixes #58664.
See #39941.

Location:

trunk

Files:

• composer.json (modified) (1 diff)
• src/wp-includes/class-wp-customize-manager.php (modified) (8 diffs)
• src/wp-includes/class-wp-customize-nav-menus.php (modified) (1 diff)
• src/wp-includes/class-wp-customize-widgets.php (modified) (1 diff)
• src/wp-includes/class-wp-scripts.php (modified) (7 diffs)
• src/wp-includes/comment-template.php (modified) (1 diff)
• src/wp-includes/customize/class-wp-customize-selective-refresh.php (modified) (1 diff)
• src/wp-includes/functions.php (modified) (2 diffs)
• src/wp-includes/script-loader.php (modified) (3 diffs)
• src/wp-includes/theme-templates.php (modified) (2 diffs)
• src/wp-includes/theme.php (modified) (2 diffs)
• src/wp-includes/widgets/class-wp-widget-archives.php (modified) (3 diffs)
• src/wp-includes/widgets/class-wp-widget-categories.php (modified) (2 diffs)
• src/wp-login.php (modified) (7 diffs)
• tests/phpunit/tests/customize/manager.php (modified) (1 diff)
• tests/phpunit/tests/dependencies/scripts.php (modified) (56 diffs)
• tests/phpunit/tests/dependencies/wpInlineScriptTag.php (modified) (1 diff)

trunk/composer.json

@@ -12 +12 @@
     "require": {
         "php": ">=7.0"
+    },
+    "suggest": {
+        "ext-dom": "*"
     },
     "require-dev": {

trunk/src/wp-includes/class-wp-customize-manager.php

@@ -465 +465 @@
                 'error'         => $ajax_message,
             );
+            $message .= ob_get_clean();
+            ob_start();
             ?>
             <script>
@@ -473 +475 @@
             </script>
             <?php
-            $message .= ob_get_clean();
+            $message .= wp_get_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
         }
 
@@ -2084 +2086 @@
             return;
         }
+        ob_start();
         ?>
         <script>
@@ -2107 +2110 @@
         </script>
         <?php
+        wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
     }
 
@@ -2202 +2206 @@
         }
 
+        ob_start();
         ?>
-        <script type="text/javascript">
+        <script>
             var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
             _wpCustomizeSettings.values = {};
@@ -2226 +2231 @@
         </script>
         <?php
+        wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
     }
 
@@ -4977 +4983 @@
         }
 
+        ob_start();
         ?>
-        <script type="text/javascript">
+        <script>
             var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
             _wpCustomizeSettings.initialClientTimestamp = _.now();
@@ -5013 +5020 @@
         </script>
         <?php
+        wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
     }
 

trunk/src/wp-includes/class-wp-customize-nav-menus.php

@@ -1560 +1560 @@
             'navMenuInstanceArgs' => $this->preview_nav_menu_instance_args,
         );
-        printf( '<script>var _wpCustomizePreviewNavMenusExports = %s;</script>', wp_json_encode( $exports ) );
+        wp_print_inline_script_tag( sprintf( 'var _wpCustomizePreviewNavMenusExports = %s;', wp_json_encode( $exports ) ) );
     }
 

trunk/src/wp-includes/class-wp-customize-widgets.php

@@ -1311 +1311 @@
             unset( $registered_widget['callback'] ); // May not be JSON-serializeable.
         }
-
-        ?>
-        <script type="text/javascript">
-            var _wpWidgetCustomizerPreviewSettings = <?php echo wp_json_encode( $settings ); ?>;
-        </script>
-        <?php
+        wp_print_inline_script_tag(
+            sprintf( 'var _wpWidgetCustomizerPreviewSettings = %s;', wp_json_encode( $settings ) )
+        );
     }
 

trunk/src/wp-includes/class-wp-scripts.php

@@ -124 +124 @@
 
     /**
-     * Holds a string which contains the type attribute for script tag.
-     *
-     * If the active theme does not declare HTML5 support for 'script',
-     * then it initializes as `type='text/javascript'`.
-     *
-     * @since 5.3.0
-     * @var string
-     */
-    private $type_attr = '';
-
-    /**
      * Holds a mapping of dependents (as handles) for a given script handle.
      * Used to optimize recursive dependency tree checks.
@@ -168 +157 @@
      */
     public function init() {
-        if (
-            function_exists( 'is_admin' ) && ! is_admin()
-        &&
-            function_exists( 'current_theme_supports' ) && ! current_theme_supports( 'html5', 'script' )
-        ) {
-            $this->type_attr = " type='text/javascript'";
-        }
-
         /**
          * Fires when the WP_Scripts instance is initialized.
@@ -246 +227 @@
         }
 
-        printf( "<script%s id='%s-js-extra'>\n", $this->type_attr, esc_attr( $handle ) );
-
-        // CDATA is not needed for HTML 5.
-        if ( $this->type_attr ) {
-            echo "/* <![CDATA[ */\n";
-        }
-
-        echo "$output\n";
-
-        if ( $this->type_attr ) {
-            echo "/* ]]> */\n";
-        }
-
-        echo "</script>\n";
+        wp_print_inline_script_tag( $output, array( 'id' => "{$handle}-js-extra" ) );
 
         return true;
@@ -336 +304 @@
         $translations = $this->print_translations( $handle, false );
         if ( $translations ) {
-            $translations = sprintf( "<script%s id='%s-js-translations'>\n%s\n</script>\n", $this->type_attr, esc_attr( $handle ), $translations );
+            $translations = wp_get_inline_script_tag( $translations, array( 'id' => "{$handle}-js-translations" ) );
         }
 
@@ -404 +372 @@
 
         /** This filter is documented in wp-includes/class-wp-scripts.php */
-        $src = esc_url( apply_filters( 'script_loader_src', $src, $handle ) );
+        $src = esc_url_raw( apply_filters( 'script_loader_src', $src, $handle ) );
 
         if ( ! $src ) {
@@ -410 +378 @@
         }
 
+        $attr = array(
+            'src' => $src,
+            'id'  => "{$handle}-js",
+        );
+        if ( $strategy ) {
+            $attr[ $strategy ] = true;
+        }
+        if ( $intended_strategy ) {
+            $attr['data-wp-strategy'] = $intended_strategy;
+        }
         $tag  = $translations . $cond_before . $before_script;
-        $tag .= sprintf(
-            "<script%s src='%s' id='%s-js'%s%s></script>\n",
-            $this->type_attr,
-            $src, // Value is escaped above.
-            esc_attr( $handle ),
-            $strategy ? " {$strategy}" : '',
-            $intended_strategy ? " data-wp-strategy='{$intended_strategy}'" : ''
-        );
+        $tag .= wp_get_script_tag( $attr );
         $tag .= $after_script . $cond_after;
 
@@ -721 +692 @@
 
         if ( $display ) {
-            printf( "<script%s id='%s-js-translations'>\n%s\n</script>\n", $this->type_attr, esc_attr( $handle ), $output );
+            wp_print_inline_script_tag( $output, array( 'id' => "{$handle}-js-translations" ) );
         }
 

trunk/src/wp-includes/comment-template.php

@@ -1367 +1367 @@
     if ( current_user_can( 'unfiltered_html' ) ) {
         wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false );
-        echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n";
+        wp_print_inline_script_tag( "(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();" );
     }
 }

trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php

@@ -194 +194 @@
 
         // Export data to JS.
-        printf( '<script>var _customizePartialRefreshExports = %s;</script>', wp_json_encode( $exports ) );
+        wp_print_inline_script_tag( sprintf( 'var _customizePartialRefreshExports = %s;', wp_json_encode( $exports ) ) );
     }
 

trunk/src/wp-includes/functions.php

@@ -7656 +7656 @@
     $name = 'wp-preview-' . (int) $post->ID;
 
+    ob_start();
     ?>
     <script>
@@ -7671 +7672 @@
     </script>
     <?php
+    wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
 }
 

trunk/src/wp-includes/script-loader.php

@@ -2788 +2788 @@
 function wp_get_script_tag( $attributes ) {
     if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
-        $attributes['type'] = 'text/javascript';
+        // Keep the type attribute as the first for legacy reasons (it has always been this way in core).
+        $attributes = array_merge(
+            array( 'type' => 'text/javascript' ),
+            $attributes
+        );
     }
     /**
@@ -2831 +2835 @@
  */
 function wp_get_inline_script_tag( $javascript, $attributes = array() ) {
-    if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
-        $attributes['type'] = 'text/javascript';
-    }
+    $is_html5 = current_theme_supports( 'html5', 'script' ) || is_admin();
+    if ( ! isset( $attributes['type'] ) && ! $is_html5 ) {
+        // Keep the type attribute as the first for legacy reasons (it has always been this way in core).
+        $attributes = array_merge(
+            array( 'type' => 'text/javascript' ),
+            $attributes
+        );
+    }
+
+    // Ensure markup is XHTML compatible if not HTML5.
+    if ( ! $is_html5 ) {
+        $javascript = str_replace( ']]>', ']]]]><![CDATA[>', $javascript ); // Escape any existing CDATA section.
+        $javascript = sprintf( "/* <![CDATA[ */\n%s\n/* ]]> */", $javascript );
+    }
+
+    $javascript = "\n" . trim( $javascript, "\n\r " ) . "\n";
+
     /**
      * Filters attributes to be added to a script tag.
@@ -2845 +2863 @@
      */
     $attributes = apply_filters( 'wp_inline_script_attributes', $attributes, $javascript );
-
-    $javascript = "\n" . trim( $javascript, "\n\r " ) . "\n";
 
     return sprintf( "<script%s>%s</script>\n", wp_sanitize_script_attributes( $attributes ), $javascript );

trunk/src/wp-includes/theme-templates.php

@@ -161 +161 @@
 
     /**
-     * Print the skip-link script.
+     * Enqueue the skip-link script.
      */
+    ob_start();
     ?>
     <script>
@@ -205 +206 @@
     </script>
     <?php
+    $skip_link_script = str_replace( array( '<script>', '</script>' ), '', ob_get_clean() );
+    $script_handle    = 'wp-block-template-skip-link';
+    wp_register_script( $script_handle, false );
+    wp_add_inline_script( $script_handle, $skip_link_script );
+    wp_enqueue_script( $script_handle );
 }
 

trunk/src/wp-includes/theme.php

@@ -3784 +3784 @@
     $home_origin  = parse_url( home_url() );
     $cross_domain = ( strtolower( $admin_origin['host'] ) !== strtolower( $home_origin['host'] ) );
-    $type_attr    = current_theme_supports( 'html5', 'script' ) ? '' : ' type="text/javascript"';
+    ob_start();
     ?>
-    <script<?php echo $type_attr; ?>>
+    <script>
         (function() {
             var request, b = document.body, c = 'className', cs = 'customize-support', rcs = new RegExp('(^|\\s+)(no-)?'+cs+'(\\s+|$)');
@@ -3802 +3802 @@
     </script>
     <?php
+    wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
 }
 

trunk/src/wp-includes/widgets/class-wp-widget-archives.php

@@ -101 +101 @@
                     break;
             }
-
-            $type_attr = current_theme_supports( 'html5', 'script' ) ? '' : ' type="text/javascript"';
             ?>
 
@@ -110 +108 @@
         </select>
 
-<script<?php echo $type_attr; ?>>
-/* <![CDATA[ */
+            <?php ob_start(); ?>
+<script>
 (function() {
     var dropdown = document.getElementById( "<?php echo esc_js( $dropdown_id ); ?>" );
@@ -121 +119 @@
     dropdown.onchange = onSelectChange;
 })();
-/* ]]> */
 </script>
             <?php
+            wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
         } else {
             $format = current_theme_supports( 'html5', 'navigation-widgets' ) ? 'html5' : 'xhtml';

trunk/src/wp-includes/widgets/class-wp-widget-categories.php

@@ -93 +93 @@
             echo '</form>';
 
-            $type_attr = current_theme_supports( 'html5', 'script' ) ? '' : ' type="text/javascript"';
+            ob_start();
             ?>
 
-<script<?php echo $type_attr; ?>>
-/* <![CDATA[ */
+<script>
 (function() {
     var dropdown = document.getElementById( "<?php echo esc_js( $dropdown_id ); ?>" );
@@ -107 +106 @@
     dropdown.onchange = onCatChange;
 })();
-/* ]]> */
 </script>
 
             <?php
+            wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
         } else {
             $format = current_theme_supports( 'html5', 'navigation-widgets' ) ? 'html5' : 'xhtml';

trunk/src/wp-login.php

@@ -102 +102 @@
      */
     if ( 'loggedout' === $wp_error->get_error_code() ) {
+        ob_start();
         ?>
         <script>if("sessionStorage" in window){try{for(var key in sessionStorage){if(key.indexOf("wp-autosave-")!=-1){sessionStorage.removeItem(key)}}}catch(e){}};</script>
         <?php
+        wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
     }
 
@@ -194 +196 @@
     </head>
     <body class="login no-js <?php echo esc_attr( implode( ' ', $classes ) ); ?>">
-    <script type="text/javascript">
-        document.body.className = document.body.className.replace('no-js','js');
-    </script>
+    <?php
+    wp_print_inline_script_tag( "document.body.className = document.body.className.replace('no-js','js');" );
+    ?>
+
     <?php
     /**
@@ -415 +418 @@
 
     if ( ! empty( $input_id ) ) {
+        ob_start();
         ?>
-        <script type="text/javascript">
+        <script>
         try{document.getElementById('<?php echo $input_id; ?>').focus();}catch(e){}
         if(typeof wpOnload==='function')wpOnload();
         </script>
         <?php
+        wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
     }
 
@@ -442 +447 @@
  */
 function wp_shake_js() {
-    ?>
-    <script type="text/javascript">
-    document.querySelector('form').classList.add('shake');
-    </script>
-    <?php
+    wp_print_inline_script_tag( "document.querySelector('form').classList.add('shake');" );
 }
 
@@ -1358 +1359 @@
 
                 if ( $customize_login ) {
+                    ob_start();
                     ?>
-                    <script type="text/javascript">setTimeout( function(){ new wp.customize.Messenger({ url: '<?php echo wp_customize_url(); ?>', channel: 'login' }).send('login') }, 1000 );</script>
+                    <script>setTimeout( function(){ new wp.customize.Messenger({ url: '<?php echo wp_customize_url(); ?>', channel: 'login' }).send('login') }, 1000 );</script>
                     <?php
+                    wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
                 }
 
@@ -1606 +1609 @@
         $login_script .= "if ( typeof wpOnload === 'function' ) { wpOnload() }";
 
-        ?>
-        <script type="text/javascript">
-            <?php echo $login_script; ?>
-        </script>
-        <?php
+        wp_print_inline_script_tag( $login_script );
 
         if ( $interim_login ) {
+            ob_start();
             ?>
-            <script type="text/javascript">
+            <script>
             ( function() {
                 try {
@@ -1628 +1628 @@
             </script>
             <?php
+            wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
         }
 

trunk/tests/phpunit/tests/customize/manager.php

@@ -3137 +3137 @@
         $manager->remove_frameless_preview_messenger_channel();
         $output = ob_get_clean();
-        $this->assertStringContainsString( '<script>', $output );
+        $this->assertStringContainsString( '<script', $output );
     }
 

trunk/tests/phpunit/tests/dependencies/scripts.php

@@ -43 +43 @@
         $this->wp_scripts_print_translations_output  = <<<JS
 <script type='text/javascript' id='__HANDLE__-js-translations'>
+/* <![CDATA[ */
 ( function( domain, translations ) {
     var localeData = translations.locale_data[ domain ] || translations.locale_data.messages;
@@ -48 +49 @@
     wp.i18n.setLocaleData( localeData, domain );
 } )( "__DOMAIN__", __JSON_TRANSLATIONS__ );
+/* ]]> */
 </script>
 JS;
@@ -78 +80 @@
         $expected .= "<script type='text/javascript' src='http://example.com' id='empty-deps-null-version-js'></script>\n";
 
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
 
         // No scripts left to print.
@@ -119 +121 @@
         $expected  = "<script type='text/javascript' src='http://example.org/ms-isa-1.js' id='ms-isa-1-js' data-wp-strategy='{$strategy}'></script>\n";
         $expected .= wp_get_inline_script_tag(
-            "console.log(\"after one\");\n",
+            'console.log("after one");',
             array(
                 'id' => 'ms-isa-1-js-after',
             )
         );
-        $this->assertSame( $expected, $output, 'Inline scripts in the "after" position, that are attached to a deferred main script, are failing to print/execute.' );
+        $this->assertEqualMarkup( $expected, $output, 'Inline scripts in the "after" position, that are attached to a deferred main script, are failing to print/execute.' );
     }
 
@@ -147 +149 @@
         $expected  = "<script type='text/javascript' src='http://example.org/ms-insa-3.js' id='ms-insa-3-js'></script>\n";
         $expected .= wp_get_inline_script_tag(
-            "console.log(\"after one\");\n",
+            'console.log("after one");',
             array(
                 'id' => 'ms-insa-3-js-after',
@@ -153 +155 @@
         );
 
-        $this->assertSame( $expected, $output, 'Inline scripts in the "after" position, that are attached to a blocking main script, are failing to print/execute.' );
+        $this->assertEqualMarkup( $expected, $output, 'Inline scripts in the "after" position, that are attached to a blocking main script, are failing to print/execute.' );
     }
 
@@ -181 +183 @@
 
         $expected  = wp_get_inline_script_tag(
-            "console.log(\"before first\");\n",
+            'console.log("before first");',
             array(
                 'id' => 'ds-i1-1-js-before',
@@ -190 +192 @@
         $expected .= "<script type='text/javascript' src='http://example.org/ds-i1-3.js' id='ds-i1-3-js' $strategy data-wp-strategy='{$strategy}'></script>\n";
         $expected .= wp_get_inline_script_tag(
-            "console.log(\"before last\");\n",
+            'console.log("before last");',
             array(
                 'id'   => 'ms-i1-1-js-before',
@@ -198 +200 @@
         $expected .= "<script type='text/javascript' src='http://example.org/ms-i1-1.js' id='ms-i1-1-js' {$strategy} data-wp-strategy='{$strategy}'></script>\n";
 
-        $this->assertSame( $expected, $output, 'Inline scripts in the "before" position, that are attached to a deferred main script, are failing to print/execute.' );
+        $this->assertEqualMarkup( $expected, $output, 'Inline scripts in the "before" position, that are attached to a deferred main script, are failing to print/execute.' );
     }
 
@@ -216 +218 @@
         $output   = get_echo( 'wp_print_scripts' );
         $expected = "<script type='text/javascript' src='/main-script-a1.js' id='main-script-a1-js' async data-wp-strategy='async'></script>\n";
-        $this->assertSame( $expected, $output, 'Scripts enqueued with an async loading strategy are failing to have the async attribute applied to the script handle when being printed.' );
+        $this->assertEqualMarkup( $expected, $output, 'Scripts enqueued with an async loading strategy are failing to have the async attribute applied to the script handle when being printed.' );
     }
 
@@ -236 +238 @@
         wp_enqueue_script( 'dependency-script-a2', '/dependency-script-a2.js', array(), null );
         wp_enqueue_script( 'main-script-a2', '/main-script-a2.js', array( 'dependency-script-a2' ), null, compact( 'strategy' ) );
-        $output   = get_echo( 'wp_print_scripts' );
-        $expected = "<script type='text/javascript' src='/main-script-a2.js' id='main-script-a2-js' {$strategy} data-wp-strategy='{$strategy}'></script>";
-        $this->assertStringContainsString( $expected, $output, 'Dependents of a blocking dependency are free to have any strategy.' );
+        $output    = get_echo( 'wp_print_scripts' );
+        $expected  = "<script id='dependency-script-a2-js' src='/dependency-script-a2.js'></script>\n";
+        $expected .= "<script type='text/javascript' src='/main-script-a2.js' id='main-script-a2-js' {$strategy} data-wp-strategy='{$strategy}'></script>";
+        $this->assertEqualMarkup( $expected, $output, 'Dependents of a blocking dependency are free to have any strategy.' );
     }
 
@@ -258 +261 @@
         wp_enqueue_script( 'dependent-script-a3', '/dependent-script-a3.js', array( 'main-script-a3' ), null );
         $output   = get_echo( 'wp_print_scripts' );
-        $expected = "<script type='text/javascript' src='/main-script-a3.js' id='main-script-a3-js' data-wp-strategy='{$strategy}'></script>";
+        $expected = str_replace( "'", '"', "<script type='text/javascript' src='/main-script-a3.js' id='main-script-a3-js' data-wp-strategy='{$strategy}'></script>" );
         $this->assertStringContainsString( $expected, $output, 'Blocking dependents must force delayed dependencies to become blocking.' );
     }
@@ -276 +279 @@
      */
     public function test_delayed_dependent_with_blocking_dependency_not_enqueued( $strategy ) {
+        $this->add_html5_script_theme_support();
         wp_enqueue_script( 'main-script-a4', '/main-script-a4.js', array(), null, compact( 'strategy' ) );
         // This dependent is registered but not enqueued, so it should not factor into the eligible loading strategy.
         wp_register_script( 'dependent-script-a4', '/dependent-script-a4.js', array( 'main-script-a4' ), null );
         $output   = get_echo( 'wp_print_scripts' );
-        $expected = "<script type='text/javascript' src='/main-script-a4.js' id='main-script-a4-js' {$strategy} data-wp-strategy='{$strategy}'></script>";
+        $expected = str_replace( "'", '"', "<script src='/main-script-a4.js' id='main-script-a4-js' {$strategy} data-wp-strategy='{$strategy}'></script>" );
         $this->assertStringContainsString( $expected, $output, 'Only enqueued dependents should affect the eligible strategy.' );
     }
@@ -965 +969 @@
      */
     public function test_loading_strategy_with_defer_having_no_dependents_nor_dependencies() {
+        $this->add_html5_script_theme_support();
         wp_enqueue_script( 'main-script-d1', 'http://example.com/main-script-d1.js', array(), null, array( 'strategy' => 'defer' ) );
         $output   = get_echo( 'wp_print_scripts' );
-        $expected = "<script type='text/javascript' src='http://example.com/main-script-d1.js' id='main-script-d1-js' defer data-wp-strategy='defer'></script>\n";
+        $expected = str_replace( "'", '"', "<script src='http://example.com/main-script-d1.js' id='main-script-d1-js' defer data-wp-strategy='defer'></script>\n" );
         $this->assertStringContainsString( $expected, $output, 'Expected defer, as there is no dependent or dependency' );
     }
@@ -981 +986 @@
      */
     public function test_loading_strategy_with_defer_dependent_and_varied_dependencies() {
+        $this->add_html5_script_theme_support();
         wp_enqueue_script( 'dependency-script-d2-1', 'http://example.com/dependency-script-d2-1.js', array(), null, array( 'strategy' => 'defer' ) );
         wp_enqueue_script( 'dependency-script-d2-2', 'http://example.com/dependency-script-d2-2.js', array(), null );
@@ -986 +992 @@
         wp_enqueue_script( 'main-script-d2', 'http://example.com/main-script-d2.js', array( 'dependency-script-d2-1', 'dependency-script-d2-3' ), null, array( 'strategy' => 'defer' ) );
         $output   = get_echo( 'wp_print_scripts' );
-        $expected = "<script type='text/javascript' src='http://example.com/main-script-d2.js' id='main-script-d2-js' defer data-wp-strategy='defer'></script>\n";
+        $expected = '<script src="http://example.com/main-script-d2.js" id="main-script-d2-js" defer data-wp-strategy="defer"></script>';
         $this->assertStringContainsString( $expected, $output, 'Expected defer, as all dependencies are either deferred or blocking' );
     }
@@ -1000 +1006 @@
      */
     public function test_loading_strategy_with_all_defer_dependencies() {
+        $this->add_html5_script_theme_support();
         wp_enqueue_script( 'main-script-d3', 'http://example.com/main-script-d3.js', array(), null, array( 'strategy' => 'defer' ) );
         wp_enqueue_script( 'dependent-script-d3-1', 'http://example.com/dependent-script-d3-1.js', array( 'main-script-d3' ), null, array( 'strategy' => 'defer' ) );
@@ -1005 +1012 @@
         wp_enqueue_script( 'dependent-script-d3-3', 'http://example.com/dependent-script-d3-3.js', array( 'dependent-script-d3-2' ), null, array( 'strategy' => 'defer' ) );
         $output   = get_echo( 'wp_print_scripts' );
-        $expected = "<script type='text/javascript' src='http://example.com/main-script-d3.js' id='main-script-d3-js' defer data-wp-strategy='defer'></script>\n";
+        $expected = '<script src="http://example.com/main-script-d3.js" id="main-script-d3-js" defer data-wp-strategy="defer"></script>';
         $this->assertStringContainsString( $expected, $output, 'Expected defer, as all dependents have defer loading strategy' );
     }
@@ -1030 +1037 @@
         $expected .= "<script type='text/javascript' src='/dependent-script-d4-3.js' id='dependent-script-d4-3-js' defer data-wp-strategy='defer'></script>\n";
 
-        $this->assertSame( $expected, $output, 'Scripts registered as defer but that have dependents that are async are expected to have said dependents deferred.' );
+        $this->assertEqualMarkup( $expected, $output, 'Scripts registered as defer but that have dependents that are async are expected to have said dependents deferred.' );
     }
 
@@ -1050 +1057 @@
         wp_enqueue_script( 'dependent-script-d4-3', '/dependent-script-d4-3.js', array( 'dependent-script-d4-2' ), null, array( 'strategy' => 'defer' ) );
         $output   = get_echo( 'wp_print_scripts' );
-        $expected = "<script type='text/javascript' src='/main-script-d4.js' id='main-script-d4-js' data-wp-strategy='defer'></script>\n";
+        $expected = str_replace( "'", '"', "<script type='text/javascript' src='/main-script-d4.js' id='main-script-d4-js' data-wp-strategy='defer'></script>\n" );
         $this->assertStringContainsString( $expected, $output, 'Scripts registered as defer but that have all dependents with no strategy, should become blocking (no strategy).' );
     }
@@ -1068 +1075 @@
         $output   = get_echo( 'wp_print_scripts' );
         $expected = "<script type='text/javascript' src='/main-script-b1.js' id='main-script-b1-js'></script>\n";
+        $expected = str_replace( "'", '"', $expected );
         $this->assertSame( $expected, $output, 'Scripts registered with a "blocking" strategy, and who have no dependencies, should have no loading strategy attributes printed.' );
 
@@ -1074 +1082 @@
         $output   = get_echo( 'wp_print_scripts' );
         $expected = "<script type='text/javascript' src='/main-script-b2.js' id='main-script-b2-js'></script>\n";
+        $expected = str_replace( "'", '"', $expected );
         $this->assertSame( $expected, $output, 'Scripts registered with no strategy assigned, and who have no dependencies, should have no loading strategy attributes printed.' );
     }
@@ -1100 +1109 @@
         $expected_header .= "<script type='text/javascript' src='/enqueue-header-new.js' id='enqueue-header-new-js'></script>\n";
 
-        $this->assertSame( $expected_header, $actual_header, 'Scripts registered/enqueued using the older $in_footer parameter or the newer $args parameter should have the same outcome.' );
+        $this->assertEqualMarkup( $expected_header, $actual_header, 'Scripts registered/enqueued using the older $in_footer parameter or the newer $args parameter should have the same outcome.' );
         $this->assertEmpty( $actual_footer, 'Expected footer to be empty since all scripts were for head.' );
     }
@@ -1128 +1137 @@
 
         $this->assertEmpty( $actual_header, 'Expected header to be empty since all scripts targeted footer.' );
-        $this->assertSame( $expected_footer, $actual_footer, 'Scripts registered/enqueued using the older $in_footer parameter or the newer $args parameter should have the same outcome.' );
+        $this->assertEqualMarkup( $expected_footer, $actual_footer, 'Scripts registered/enqueued using the older $in_footer parameter or the newer $args parameter should have the same outcome.' );
     }
 
@@ -1247 +1256 @@
         wp_enqueue_script( 'invalid-strategy' );
 
-        $this->assertSame(
+        $this->assertEqualMarkup(
             "<script type='text/javascript' src='/defaults.js' id='invalid-strategy-js'></script>\n",
             get_echo( 'wp_print_scripts' )
@@ -1272 +1281 @@
         wp_enqueue_script( 'invalid-strategy' );
 
-        $this->assertSame(
+        $this->assertEqualMarkup(
             "<script type='text/javascript' src='/defaults.js' id='invalid-strategy-js'></script>\n",
             get_echo( 'wp_print_scripts' )
@@ -1293 +1302 @@
         wp_enqueue_script( 'invalid-strategy', '/defaults.js', array(), null, array( 'strategy' => 'random-strategy' ) );
 
-        $this->assertSame(
+        $this->assertEqualMarkup(
             "<script type='text/javascript' src='/defaults.js' id='invalid-strategy-js'></script>\n",
             get_echo( 'wp_print_scripts' )
@@ -1331 +1340 @@
         $expected .= "<script type='text/javascript' src='/main-script.js' id='main-defer-script-js' defer data-wp-strategy='defer'></script>\n";
 
-        $this->assertSame( $expected, $print_scripts, 'Scripts are being incorrectly concatenated when a main script is registered with a "defer" loading strategy. Deferred scripts should not be part of the script concat loading query.' );
+        $this->assertEqualMarkup( $expected, $print_scripts, 'Scripts are being incorrectly concatenated when a main script is registered with a "defer" loading strategy. Deferred scripts should not be part of the script concat loading query.' );
     }
 
@@ -1366 +1375 @@
         $expected .= "<script type='text/javascript' src='/main-script.js' id='main-async-script-1-js' async data-wp-strategy='async'></script>\n";
 
-        $this->assertSame( $expected, $print_scripts, 'Scripts are being incorrectly concatenated when a main script is registered with an "async" loading strategy. Async scripts should not be part of the script concat loading query.' );
+        $this->assertEqualMarkup( $expected, $print_scripts, 'Scripts are being incorrectly concatenated when a main script is registered with an "async" loading strategy. Async scripts should not be part of the script concat loading query.' );
     }
 
@@ -1405 +1414 @@
         $expected .= "<script type='text/javascript' src='/main-script.js' id='deferred-script-2-js' defer data-wp-strategy='defer'></script>\n";
 
-        $this->assertSame( $expected, $print_scripts, 'Scripts are being incorrectly concatenated when a main script is registered as deferred after other blocking scripts are registered. Deferred scripts should not be part of the script concat loader query string. ' );
+        $this->assertEqualMarkup( $expected, $print_scripts, 'Scripts are being incorrectly concatenated when a main script is registered as deferred after other blocking scripts are registered. Deferred scripts should not be part of the script concat loader query string. ' );
     }
 
@@ -1413 +1422 @@
     public function test_wp_enqueue_script_with_html5_support_does_not_contain_type_attribute() {
         global $wp_version;
-        add_theme_support( 'html5', array( 'script' ) );
 
         $GLOBALS['wp_scripts']                  = new WP_Scripts();
@@ -1422 +1430 @@
         $expected = "<script src='http://example.com?ver={$wp_version}' id='empty-deps-no-version-js'></script>\n";
 
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -1461 +1469 @@
 
         // Go!
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
 
         // No scripts left to print.
@@ -1504 +1512 @@
 
         // Go!
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
 
         // No scripts left to print.
@@ -1522 +1530 @@
 
         // Go!
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
 
         // No scripts left to print.
@@ -1540 +1548 @@
         $expected  = "<!--[if lt IE 9]>\n<script type='text/javascript' id='test-conditional-with-data-js-extra'>\n/* <![CDATA[ */\ntesting\n/* ]]> */\n</script>\n<![endif]-->\n";
         $expected .= "<!--[if lt IE 9]>\n<script type='text/javascript' src='http://example.com' id='test-conditional-with-data-js'></script>\n<![endif]-->\n";
+        $expected  = str_replace( "'", '"', $expected );
 
         // Go!
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
 
         // No scripts left to print.
@@ -1560 +1569 @@
 
         // Go!
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
 
         // No scripts left to print.
-        $this->assertSame( '', get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( '', get_echo( 'wp_print_scripts' ) );
     }
 
@@ -1589 +1598 @@
         wp_enqueue_script( 'handle-three' );
 
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -1677 +1686 @@
         $expected_footer  = "<script type='text/javascript' src='/parent.js' id='parent-js'></script>\n";
 
-        $this->assertSame( $expected_header, $header, 'Expected same header markup.' );
-        $this->assertSame( $expected_footer, $footer, 'Expected same footer markup.' );
+        $this->assertEqualMarkup( $expected_header, $header, 'Expected same header markup.' );
+        $this->assertEqualMarkup( $expected_footer, $footer, 'Expected same footer markup.' );
     }
 
@@ -1698 +1707 @@
         $expected_footer .= "<script type='text/javascript' src='/parent.js' id='parent-js'></script>\n";
 
-        $this->assertSame( $expected_header, $header, 'Expected same header markup.' );
-        $this->assertSame( $expected_footer, $footer, 'Expected same footer markup.' );
+        $this->assertEqualMarkup( $expected_header, $header, 'Expected same header markup.' );
+        $this->assertEqualMarkup( $expected_footer, $footer, 'Expected same footer markup.' );
     }
 
@@ -1729 +1738 @@
         $expected_footer .= "<script type='text/javascript' src='/parent-footer.js' id='parent-footer-js'></script>\n";
 
-        $this->assertSame( $expected_header, $header, 'Expected same header markup.' );
-        $this->assertSame( $expected_footer, $footer, 'Expected same footer markup.' );
+        $this->assertEqualMarkup( $expected_header, $header, 'Expected same header markup.' );
+        $this->assertEqualMarkup( $expected_footer, $footer, 'Expected same footer markup.' );
     }
 
@@ -1953 +1962 @@
         $expected_localized .= "<script type='text/javascript' id='test-example-js-extra'>\n/* <![CDATA[ */\nvar testExample = {\"foo\":\"bar\"};\n/* ]]> */\n</script>\n";
         $expected_localized .= "<![endif]-->\n";
+        $expected_localized  = str_replace( "'", '"', $expected_localized );
 
         $expected  = "<!--[if gte IE 9]>\n";
@@ -1959 +1969 @@
         $expected .= "<script type='text/javascript' id='test-example-js-after'>\nconsole.log(\"after\");\n</script>\n";
         $expected .= "<![endif]-->\n";
+        $expected  = str_replace( "'", '"', $expected );
 
         wp_enqueue_script( 'test-example', 'example.com', array(), null );
@@ -2125 +2136 @@
         $print_scripts = $this->getActualOutput();
 
-        $tail = substr( $print_scripts, strrpos( $print_scripts, "<script type='text/javascript' src='/customize-dependency.js' id='customize-dependency-js'>" ) );
+        $tail = substr( $print_scripts, strrpos( $print_scripts, '<script type="text/javascript" src="/customize-dependency.js" id="customize-dependency-js">' ) );
+
         $this->assertEqualMarkup( $expected_tail, $tail );
     }
@@ -2305 +2317 @@
         $expected .= "<script type='text/javascript' src='/wp-includes/js/script.js' id='test-example-js'></script>\n";
 
-        $this->assertSameIgnoreEOL( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2332 +2344 @@
         $expected .= "<script type='text/javascript' src='/wp-content/plugins/my-plugin/js/script.js' id='plugin-example-js'></script>\n";
 
-        $this->assertSameIgnoreEOL( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2359 +2371 @@
         $expected .= "<script type='text/javascript' src='/wp-content/themes/my-theme/js/script.js' id='theme-example-js'></script>\n";
 
-        $this->assertSameIgnoreEOL( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2386 +2398 @@
         $expected .= "<script type='text/javascript' src='/wp-admin/js/script.js' id='script-handle-js'></script>\n";
 
-        $this->assertSameIgnoreEOL( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2416 +2428 @@
         $expected .= "<script type='text/javascript' src='/wp-admin/js/script.js' id='test-example-js'></script>\n";
 
-        $this->assertSameIgnoreEOL( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2445 +2457 @@
         $expected .= "<script type='text/javascript' src='/wp-includes/js/script.js' id='test-example-js'></script>\n";
 
-        $this->assertSameIgnoreEOL( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2475 +2487 @@
         $expected .= "<script type='text/javascript' src='/wp-includes/js/script2.js' id='test-example-js'></script>\n";
 
-        $this->assertSameIgnoreEOL( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2864 +2876 @@
         $expected .= "<script type='text/javascript' src='http://example.com' id='test-example-js'></script>\n";
 
-        $this->assertSame( $expected, get_echo( 'wp_print_scripts' ) );
+        $this->assertEqualMarkup( $expected, get_echo( 'wp_print_scripts' ) );
     }
 
@@ -2929 +2941 @@
         $expected .= "<script type='text/javascript' src='/default/common.js' id='common-js'></script>\n";
 
-        $this->assertSame( $expected, $print_scripts );
+        $this->assertEqualMarkup( $expected, $print_scripts );
     }
 
@@ -2968 +2980 @@
      *
      * @param string $markup Markup.
-     * @return DOMElement Body element wrapping supplied markup fragment.
+     * @return DOMDocument Document containing the normalized markup fragment.
      */
     protected function parse_markup_fragment( $markup ) {
@@ -2986 +2998 @@
         }
 
-        return $body;
-    }
-
-    /**
-     * Assert markup is equal.
+        return $dom;
+    }
+
+    /**
+     * Assert markup is equal after normalizing script tags.
      *
      * @param string $expected Expected markup.
@@ -2997 +3009 @@
      */
     protected function assertEqualMarkup( $expected, $actual, $message = '' ) {
+        $expected_dom = $this->parse_markup_fragment( $expected );
+        $actual_dom   = $this->parse_markup_fragment( $actual );
+        foreach ( array( $expected_dom, $actual_dom ) as $dom ) {
+            $xpath = new DOMXPath( $dom );
+            /** @var DOMElement $script */
+
+            // Normalize type attribute. When missing, it defaults to text/javascript.
+            foreach ( $xpath->query( '//script[ not( @type ) ]' ) as $script ) {
+                $script->setAttribute( 'type', 'text/javascript' );
+            }
+
+            // Normalize script contents to remove CDATA wrapper.
+            foreach ( $xpath->query( '//script[ contains( text(), "<![CDATA[" ) ]' ) as $script ) {
+                $script->textContent = str_replace(
+                    array(
+                        "/* <![CDATA[ */\n",
+                        "\n/* ]]> */",
+                    ),
+                    '',
+                    $script->textContent
+                );
+            }
+
+            // Normalize XHTML-compatible boolean attributes to HTML5 ones.
+            foreach ( array( 'async', 'defer' ) as $attribute ) {
+                foreach ( iterator_to_array( $xpath->query( "//script[ @{$attribute} = '{$attribute}' ]" ) ) as $script ) {
+                    $script->removeAttribute( $attribute );
+                    $script->setAttributeNode( $dom->createAttribute( $attribute ) );
+                }
+            }
+        }
+
         $this->assertEquals(
-            $this->parse_markup_fragment( $expected ),
-            $this->parse_markup_fragment( $actual ),
+            $expected_dom->getElementsByTagName( 'body' )->item( 0 ),
+            $actual_dom->getElementsByTagName( 'body' )->item( 0 ),
             $message
         );
     }
+
+    /**
+     * Adds html5 script theme support.
+     */
+    protected function add_html5_script_theme_support() {
+        add_theme_support( 'html5', array( 'script' ) );
+    }
 }

trunk/tests/phpunit/tests/dependencies/wpInlineScriptTag.php

@@ -120 +120 @@
         );
     }
+
+    /**
+     * Tests that CDATA wrapper duplication is handled.
+     *
+     * @ticket 58664
+     */
+    public function test_get_inline_script_tag_with_duplicated_cdata_wrappers() {
+        remove_theme_support( 'html5' );
+
+        $this->assertSame(
+            "<script type=\"text/javascript\">\n/* <![CDATA[ */\n/* <![CDATA[ */ console.log( 'Hello World!' ); /* ]]]]><![CDATA[> */\n/* ]]> */\n</script>\n",
+            wp_get_inline_script_tag( "/* <![CDATA[ */ console.log( 'Hello World!' ); /* ]]> */" )
+        );
+    }
 }