Changeset 58977 for trunk/src/wp-includes/html-api/class-wp-html-processor.php

Timestamp:

09/03/2024 07:48:57 PM (15 months ago)

Author:

dmsnell

Message:

HTML API: Ensure that NULL and whitespace-only CDATA sections don't forbid FRAMESET.

When CDATA sections (which can only occur inside SVG and MathML content) consist only of NULL bytes or whitespace characters they should not clear the "frameset ok" flag. Previously they have always been clearing this flag, but in this patch the logic is updated to detect these sequences properly.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/7230
Discussed in https://core.trac.wordpress.org/ticket/61576

Follow-up to [58867].

Props dmsnell, jonsurrell.
See #61576.

File:

• trunk/src/wp-includes/html-api/class-wp-html-processor.php (modified) (3 diffs)

trunk/src/wp-includes/html-api/class-wp-html-processor.php

@@ -844 +844 @@
         if ( self::PROCESS_NEXT_NODE === $node_to_process ) {
             parent::next_token();
-            if (
-                WP_HTML_Tag_Processor::STATE_TEXT_NODE === $this->parser_state ||
-                WP_HTML_Tag_Processor::STATE_CDATA_NODE === $this->parser_state
-            ) {
+            if ( WP_HTML_Tag_Processor::STATE_TEXT_NODE === $this->parser_state ) {
                 parent::subdivide_text_appropriately();
             }
@@ -4376 +4373 @@
 
         switch ( $op ) {
-            case '#cdata-section':
             case '#text':
                 /*
@@ -4390 +4386 @@
                  */
                 if ( parent::TEXT_IS_GENERIC === $this->text_node_classification ) {
+                    $this->state->frameset_ok = false;
+                }
+
+                $this->insert_foreign_element( $this->state->current_token, false );
+                return true;
+
+            /*
+             * CDATA sections are alternate wrappers for text content and therefore
+             * ought to follow the same rules as text nodes.
+             */
+            case '#cdata-section':
+                /*
+                 * NULL bytes and whitespace do not change the frameset-ok flag.
+                 */
+                $current_token        = $this->bookmarks[ $this->state->current_token->bookmark_name ];
+                $cdata_content_start  = $current_token->start + 9;
+                $cdata_content_length = $current_token->length - 12;
+                if ( strspn( $this->html, "\0 \t\n\f\r", $cdata_content_start, $cdata_content_length ) !== $cdata_content_length ) {
                     $this->state->frameset_ok = false;
                 }