Changeset 56687 for trunk/src/wp-includes/class-wp-scripts.php

Timestamp:

09/25/2023 09:03:19 PM (15 months ago)

Author:

westonruter

Message:

Script Loader: Use wp_get_script_tag() and wp_get_inline_script_tag()/wp_print_inline_script_tag() helper functions to output scripts on the frontend and login screen.

Using script tag helper functions allows plugins to employ the wp_script_attributes and wp_inline_script_attributes filters to inject the nonce attribute to apply Content Security Policy (e.g. Strict CSP). Use of helper functions also simplifies logic in WP_Scripts.

• Update wp_get_inline_script_tag() to wrap inline script in CDATA blocks for XHTML-compatibility when not using HTML5.
• Ensure the type attribute is printed first in wp_get_inline_script_tag() for back-compat.
• Wrap existing <script> tags in output buffering to retain IDE supports.
• In wp_get_inline_script_tag(), append the newline to $javascript before it is passed into the wp_inline_script_attributes filter so that the CSP hash can be computed properly.
• In the_block_template_skip_link(), opt to enqueue the inline script rather than print it.
• Add ext-php to composer.json under suggest as previously it was an undeclared dependency for running PHPUnit tests.
• Update tests to rely on DOMDocument to compare script markup, normalizing unsemantic differences.

Props westonruter, spacedmonkey, flixos90, 10upsimon, dmsnell, mukesh27, joemcgill, swissspidy, azaozz.
Fixes #58664.
See #39941.

File:

• trunk/src/wp-includes/class-wp-scripts.php (modified) (7 diffs)

trunk/src/wp-includes/class-wp-scripts.php

@@ -124 +124 @@
 
     /**
-     * Holds a string which contains the type attribute for script tag.
-     *
-     * If the active theme does not declare HTML5 support for 'script',
-     * then it initializes as `type='text/javascript'`.
-     *
-     * @since 5.3.0
-     * @var string
-     */
-    private $type_attr = '';
-
-    /**
      * Holds a mapping of dependents (as handles) for a given script handle.
      * Used to optimize recursive dependency tree checks.
@@ -168 +157 @@
      */
     public function init() {
-        if (
-            function_exists( 'is_admin' ) && ! is_admin()
-        &&
-            function_exists( 'current_theme_supports' ) && ! current_theme_supports( 'html5', 'script' )
-        ) {
-            $this->type_attr = " type='text/javascript'";
-        }
-
         /**
          * Fires when the WP_Scripts instance is initialized.
@@ -246 +227 @@
         }
 
-        printf( "<script%s id='%s-js-extra'>\n", $this->type_attr, esc_attr( $handle ) );
-
-        // CDATA is not needed for HTML 5.
-        if ( $this->type_attr ) {
-            echo "/* <![CDATA[ */\n";
-        }
-
-        echo "$output\n";
-
-        if ( $this->type_attr ) {
-            echo "/* ]]> */\n";
-        }
-
-        echo "</script>\n";
+        wp_print_inline_script_tag( $output, array( 'id' => "{$handle}-js-extra" ) );
 
         return true;
@@ -336 +304 @@
         $translations = $this->print_translations( $handle, false );
         if ( $translations ) {
-            $translations = sprintf( "<script%s id='%s-js-translations'>\n%s\n</script>\n", $this->type_attr, esc_attr( $handle ), $translations );
+            $translations = wp_get_inline_script_tag( $translations, array( 'id' => "{$handle}-js-translations" ) );
         }
 
@@ -404 +372 @@
 
         /** This filter is documented in wp-includes/class-wp-scripts.php */
-        $src = esc_url( apply_filters( 'script_loader_src', $src, $handle ) );
+        $src = esc_url_raw( apply_filters( 'script_loader_src', $src, $handle ) );
 
         if ( ! $src ) {
@@ -410 +378 @@
         }
 
+        $attr = array(
+            'src' => $src,
+            'id'  => "{$handle}-js",
+        );
+        if ( $strategy ) {
+            $attr[ $strategy ] = true;
+        }
+        if ( $intended_strategy ) {
+            $attr['data-wp-strategy'] = $intended_strategy;
+        }
         $tag  = $translations . $cond_before . $before_script;
-        $tag .= sprintf(
-            "<script%s src='%s' id='%s-js'%s%s></script>\n",
-            $this->type_attr,
-            $src, // Value is escaped above.
-            esc_attr( $handle ),
-            $strategy ? " {$strategy}" : '',
-            $intended_strategy ? " data-wp-strategy='{$intended_strategy}'" : ''
-        );
+        $tag .= wp_get_script_tag( $attr );
         $tag .= $after_script . $cond_after;
 
@@ -721 +692 @@
 
         if ( $display ) {
-            printf( "<script%s id='%s-js-translations'>\n%s\n</script>\n", $this->type_attr, esc_attr( $handle ), $output );
+            wp_print_inline_script_tag( $output, array( 'id' => "{$handle}-js-translations" ) );
         }