Changeset 60648

Timestamp:

08/19/2025 06:50:05 PM (3 months ago)

Author:

jonsurrell

Message:

Editor: Ensure preloading middleware JSON is correctly encoded.

Adds the appropriate JSON flags to wp_json_encode() to safely encode data for use in script tags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/8145.

Props jonsurrell, bernhard-reiter, dmsnell, artpi, ankitkumarshah, abcd95, dilipbheda, sainathpoojary, shanemuir.
Fixes #62797.

Location:

trunk

Files:

• src/wp-includes/block-editor.php (modified) (1 diff)
• tests/phpunit/tests/blocks/editor.php (modified) (4 diffs)

trunk/src/wp-includes/block-editor.php

@@ -767 +767 @@
         sprintf(
             'wp.apiFetch.use( wp.apiFetch.createPreloadingMiddleware( %s ) );',
-            wp_json_encode( $preload_data )
+            wp_json_encode( $preload_data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
         ),
         'after'

trunk/tests/phpunit/tests/blocks/editor.php

@@ -10 +10 @@
  */
 class Tests_Blocks_Editor extends WP_UnitTestCase {
-
     /**
      * Sets up each test method.
@@ -632 +631 @@
         $after = implode( '', wp_scripts()->registered['wp-api-fetch']->extra['after'] );
         $this->assertStringContainsString( 'wp.apiFetch.createPreloadingMiddleware', $after );
-        $this->assertStringContainsString( '"\/wp\/v2\/blocks"', $after );
-        $this->assertStringContainsString( '"\/wp\/v2\/types"', $after );
+        $this->assertStringContainsString( '"/wp/v2/blocks"', $after );
+        $this->assertStringContainsString( '"/wp/v2/types"', $after );
     }
 
@@ -698 +697 @@
             'a string without a slash'               => array(
                 'preload_paths' => array( 'wp/v2/blocks' ),
-                'expected'      => '\/wp\/v2\/blocks',
+                'expected'      => '/wp/v2/blocks',
             ),
             'a string with a slash'                  => array(
                 'preload_paths' => array( '/wp/v2/blocks' ),
-                'expected'      => '\/wp\/v2\/blocks',
+                'expected'      => '/wp/v2/blocks',
             ),
             'a string starting with a question mark' => array(
@@ -710 +709 @@
             'an array with a string without a slash' => array(
                 'preload_paths' => array( array( 'wp/v2/blocks', 'OPTIONS' ) ),
-                'expected'      => '\/wp\/v2\/blocks',
+                'expected'      => '/wp/v2/blocks',
             ),
             'an array with a string with a slash'    => array(
                 'preload_paths' => array( array( '/wp/v2/blocks', 'OPTIONS' ) ),
-                'expected'      => '\/wp\/v2\/blocks',
+                'expected'      => '/wp/v2/blocks',
             ),
             'an array with a string starting with a question mark' => array(
                 'preload_paths' => array( array( '?context=edit', 'OPTIONS' ) ),
-                'expected'      => '\/?context=edit',
-            ),
-        );
+                'expected'      => '/?context=edit',
+            ),
+        );
+    }
+
+    /**
+     * @ticket 62797
+     *
+     * @covers ::block_editor_rest_api_preload
+     *
+     * Some valid JSON-encoded data is dangerous to embed in HTML without appropriate
+     * escaping. This test includes an example of data that would prevent the enclosing
+     * `<script></script>` tag from closing on its apparent closer and remain open.
+     */
+    public function test_ensure_preload_data_script_tag_closes() {
+        add_theme_support( 'html5', array( 'script' ) );
+        register_rest_route(
+            'test/v0',
+            'test-62797',
+            array(
+                'methods'             => 'GET',
+                'callback'            => function () {
+                    return 'Unclosed comment and a script open tag <!--<script>';
+                },
+                'permission_callback' => '__return_true',
+            )
+        );
+
+        // Prevent a bunch of noisy or unstable data from being included in the test output.
+        wp_scripts()->registered['wp-api-fetch']->ver            = 'test';
+        wp_scripts()->registered['wp-api-fetch']->extra['after'] = array();
+
+        block_editor_rest_api_preload(
+            array( '/test/v0/test-62797' ),
+            new WP_Block_Editor_Context()
+        );
+
+        ob_start();
+        wp_scripts()->do_item( 'wp-api-fetch' );
+        $output = ob_get_clean();
+
+        $baseurl  = site_url();
+        $expected = <<<HTML
+<script src="{$baseurl}/wp-includes/js/dist/api-fetch.min.js?ver=test" id="wp-api-fetch-js"></script>
+<script id="wp-api-fetch-js-after">
+wp.apiFetch.use( wp.apiFetch.createPreloadingMiddleware( {"/test/v0/test-62797":{"body":["Unclosed comment and a script open tag \\u003C!--\\u003Cscript\\u003E"],"headers":{"Allow":"GET"}}} ) );
+</script>
+
+HTML;
+        $this->assertEqualHTML( $expected, $output );
     }
 }