Changeset 56748 for trunk/src/wp-login.php

Timestamp:

09/29/2023 07:45:53 PM (21 months ago)

Author:

westonruter

Message:

Script Loader: Harden removal of script tag wrappers.

• Add wp_remove_surrounding_empty_script_tags() to more precisely remove script tag wrappers and warn when doing it wrong.
• Add clarifying comments for XML escaping logic in wp_get_inline_script_tag().
• Leverage WP_HTML_Tag_Processor in test_remove_frameless_preview_messenger_channel.
• Reuse assertEqualMarkup in test_blocking_dependent_with_delayed_dependency.
• Normalize whitespace in parse_markup_fragment for assertEqualMarkup.

Follow-up to [56687].
Props dmsnell, westonruter, flixos90.
See #58664.

File:

• trunk/src/wp-login.php (modified) (4 diffs)

trunk/src/wp-login.php

@@ -106 +106 @@
         <script>if("sessionStorage" in window){try{for(var key in sessionStorage){if(key.indexOf("wp-autosave-")!=-1){sessionStorage.removeItem(key)}}}catch(e){}};</script>
         <?php
-        wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
+        wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) );
     }
 
@@ -420 +420 @@
         ob_start();
         ?>
-        <script>
+        <script type="text/javascript">
         try{document.getElementById('<?php echo $input_id; ?>').focus();}catch(e){}
         if(typeof wpOnload==='function')wpOnload();
         </script>
         <?php
-        wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
+        wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) );
     }
 
@@ -1363 +1363 @@
                     <script>setTimeout( function(){ new wp.customize.Messenger({ url: '<?php echo wp_customize_url(); ?>', channel: 'login' }).send('login') }, 1000 );</script>
                     <?php
-                    wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
+                    wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) );
                 }
 
@@ -1628 +1628 @@
             </script>
             <?php
-            wp_print_inline_script_tag( str_replace( array( '<script>', '</script>' ), '', ob_get_clean() ) );
+            wp_print_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) );
         }