Changeset 58969

Timestamp:

09/02/2024 10:26:22 PM (10 months ago)

Author:

dmsnell

Message:

HTML API: Replace null-bytes in class_list class names

As part of an audit of HTML API CSS behaviors, this patch resolves an issue with how the HTML API reports class names containing the NULL byte. NULL bytes should be replaced by the Unicode replacement character, U+FFFD, but previously weren't. This patch performs that replacement.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/7187
Discussed in https://core.trac.wordpress.org/ticket/61531

Follow-up to [56703].

Props dmsnell, jonsurrell.
See #61531.

Location:

trunk

Files:

• src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)
• tests/phpunit/tests/html-api/wpHtmlTagProcessor.php (modified) (1 diff)

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -1161 +1161 @@
              * @see https://www.w3.org/TR/CSS2/syndata.html#x1
              */
-            $name = strtolower( substr( $class, $at, $length ) );
+            $name = str_replace( "\x00", "\u{FFFD}", strtolower( substr( $class, $at, $length ) ) );
             $at  += $length;
 

trunk/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php

@@ -2235 +2235 @@
 
         $this->assertSame( array( 'one' ), $found_classes, 'Visited multiple copies of the same class name when it should have skipped the duplicates.' );
+    }
+
+    /**
+     * Ensures that null bytes are replaced with the replacement character (U+FFFD) in class_list.
+     *
+     * @ticket 61531
+     *
+     * @covers WP_HTML_Tag_Processor::class_list
+     */
+    public function test_class_list_null_bytes_replaced() {
+        $processor = new WP_HTML_Tag_Processor( "<div class='a \0 b\0 \0c\0'>" );
+        $processor->next_tag();
+
+        $found_classes = iterator_to_array( $processor->class_list() );
+
+        $this->assertSame( array( 'a', "\u{FFFD}", "b\u{FFFD}", "\u{FFFD}c\u{FFFD}" ), $found_classes );
+    }
+
+    /**
+     * Ensures that the tag processor matches class names with null bytes correctly.
+     *
+     * @ticket 61531
+     *
+     * @covers WP_HTML_Tag_Processor::has_class
+     */
+    public function test_has_class_null_byte_class_name() {
+        $processor = new WP_HTML_Tag_Processor( "<div class='null-byte-\0-there'>" );
+        $processor->next_tag();
+        $this->assertTrue( $processor->has_class( 'null-byte-�-there' ) );
     }