WordPress.org
Get WordPress

Make WordPress Core


Ignore:
Timestamp:
11/28/2024 02:25:51 PM (6 months ago)
Author:
Bernhard Reiter
Message:

HTML API: Make non-body fragment creation methods private.

The current implementation of create_fragment (and the underlying create_fragment_at_current_node) allows passing in a context that might result in a tree that cannot be represented by HTML. For example, a user might use <p> as context, and attempt to create a fragment that also consists of a paragraph element, <p>like this. This would result in a paragraph node nested inside another -- something that can never result from parsing HTML.

To prevent this, this changeset makes create_fragment_at_current_node private and limits create_fragment to only <body> as context, while a comprehensive solution to allow other contexts is being worked on.

Follow-up to [59444], [59467].
Props jonsurrell, dmsnell, bernhard-reiter.
Fixes #62584.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/wp-includes/html-api/class-wp-html-processor.php

    r59467 r59469  
    280280     * impact the parse, such as with a SCRIPT tag and its `type` attribute.
    281281     *
    282      * Example:
    283      *
    284      *     // Usually, snippets of HTML ought to be processed in the default `<body>` context:
    285      *     $processor = WP_HTML_Processor::create_fragment( '<p>Hi</p>' );
    286      *
    287      *     // Some fragments should be processed in the correct context like this SVG:
    288      *     $processor = WP_HTML_Processor::create_fragment( '<rect width="10" height="10" />', '<svg>' );
    289      *
    290      *     // This fragment with TD tags should be processed in a TR context:
    291      *     $processor = WP_HTML_Processor::create_fragment(
    292      *         '<td>1<td>2<td>3',
    293      *         '<table><tbody><tr>'
    294      *     );
    295      *
    296      * In order to create a fragment processor at the correct location, the
    297      * provided fragment will be processed as part of a full HTML document.
    298      * The processor will search for the last opener tag in the document and
    299      * create a fragment processor at that location. The document will be
    300      * forced into "no-quirks" mode by including the HTML5 doctype.
    301      *
    302      * For advanced usage and precise control over the context element, use
    303      * `WP_HTML_Processor::create_full_processor()` and
    304      * `WP_HTML_Processor::create_fragment_at_current_node()`.
    305      *
    306      * UTF-8 is the only allowed encoding. If working with a document that
    307      * isn't UTF-8, first convert the document to UTF-8, then pass in the
    308      * converted HTML.
     282     * ## Current HTML Support
     283     *
     284     *  - The only supported context is `<body>`, which is the default value.
     285     *  - The only supported document encoding is `UTF-8`, which is the default value.
    309286     *
    310287     * @since 6.4.0
    311288     * @since 6.6.0 Returns `static` instead of `self` so it can create subclass instances.
    312      * @since 6.8.0 Can create fragments with any context element.
    313289     *
    314290     * @param string $html     Input HTML fragment to process.
    315      * @param string $context  Context element for the fragment. Defaults to `<body>`.
     291     * @param string $context  Context element for the fragment, must be default of `<body>`.
    316292     * @param string $encoding Text encoding of the document; must be default of 'UTF-8'.
    317293     * @return static|null The created processor if successful, otherwise null.
    318294     */
    319295    public static function create_fragment( $html, $context = '<body>', $encoding = 'UTF-8' ) {
     296        if ( '<body>' !== $context || 'UTF-8' !== $encoding ) {
     297            return null;
     298        }
     299
    320300        $context_processor = static::create_full_parser( "<!DOCTYPE html>{$context}", $encoding );
    321301        if ( null === $context_processor ) {
    … …  
    476456     * @return static|null The created processor if successful, otherwise null.
    477457     */
    478     public function create_fragment_at_current_node( string $html ) {
     458    private function create_fragment_at_current_node( string $html ) {
    479459        if ( $this->get_token_type() !== '#tag' || $this->is_tag_closer() ) {
    480460            _doing_it_wrong(
Note: See TracChangeset for help on using the changeset viewer.