Changeset 60648

Timestamp:

08/19/2025 06:50:05 PM (12 months ago)

Author:

jonsurrell

Message:

Editor: Ensure preloading middleware JSON is correctly encoded.

Adds the appropriate JSON flags to wp_json_encode() to safely encode data for use in script tags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/8145.

Props jonsurrell, bernhard-reiter, dmsnell, artpi, ankitkumarshah, abcd95, dilipbheda, sainathpoojary, shanemuir.
Fixes #62797.

Location:

trunk

Files:

• src/wp-includes/block-editor.php (modified) (1 diff)
• tests/phpunit/tests/blocks/editor.php (modified) (4 diffs)

trunk/src/wp-includes/block-editor.php

@@ -767 +767 @@
                 sprintf(
                         'wp.apiFetch.use( wp.apiFetch.createPreloadingMiddleware( %s ) );',
-                        wp_json_encode( $preload_data )
+                        wp_json_encode( $preload_data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
                 ),
                 'after'

trunk/tests/phpunit/tests/blocks/editor.php

@@ -10 +10 @@
  */
 class Tests_Blocks_Editor extends WP_UnitTestCase {
-
         /**
          * Sets up each test method.
@@ -632 +631 @@
                 $after = implode( '', wp_scripts()->registered['wp-api-fetch']->extra['after'] );
                 $this->assertStringContainsString( 'wp.apiFetch.createPreloadingMiddleware', $after );
-                $this->assertStringContainsString( '"\/wp\/v2\/blocks"', $after );
-                $this->assertStringContainsString( '"\/wp\/v2\/types"', $after );
+                $this->assertStringContainsString( '"/wp/v2/blocks"', $after );
+                $this->assertStringContainsString( '"/wp/v2/types"', $after );
         }
 
@@ -698 +697 @@
                         'a string without a slash'               => array(
                                 'preload_paths' => array( 'wp/v2/blocks' ),
-                                'expected'      => '\/wp\/v2\/blocks',
+                                'expected'      => '/wp/v2/blocks',
                         ),
                         'a string with a slash'                  => array(
                                 'preload_paths' => array( '/wp/v2/blocks' ),
-                                'expected'      => '\/wp\/v2\/blocks',
+                                'expected'      => '/wp/v2/blocks',
                         ),
                         'a string starting with a question mark' => array(
@@ -710 +709 @@
                         'an array with a string without a slash' => array(
                                 'preload_paths' => array( array( 'wp/v2/blocks', 'OPTIONS' ) ),
-                                'expected'      => '\/wp\/v2\/blocks',
+                                'expected'      => '/wp/v2/blocks',
                         ),
                         'an array with a string with a slash'    => array(
                                 'preload_paths' => array( array( '/wp/v2/blocks', 'OPTIONS' ) ),
-                                'expected'      => '\/wp\/v2\/blocks',
+                                'expected'      => '/wp/v2/blocks',
                         ),
                         'an array with a string starting with a question mark' => array(
                                 'preload_paths' => array( array( '?context=edit', 'OPTIONS' ) ),
-                                'expected'      => '\/?context=edit',
-                        ),
-                );
+                                'expected'      => '/?context=edit',
+                        ),
+                );
+        }
+
+        /**
+         * @ticket 62797
+         *
+         * @covers ::block_editor_rest_api_preload
+         *
+         * Some valid JSON-encoded data is dangerous to embed in HTML without appropriate
+         * escaping. This test includes an example of data that would prevent the enclosing
+         * `<script></script>` tag from closing on its apparent closer and remain open.
+         */
+        public function test_ensure_preload_data_script_tag_closes() {
+                add_theme_support( 'html5', array( 'script' ) );
+                register_rest_route(
+                        'test/v0',
+                        'test-62797',
+                        array(
+                                'methods'             => 'GET',
+                                'callback'            => function () {
+                                        return 'Unclosed comment and a script open tag <!--<script>';
+                                },
+                                'permission_callback' => '__return_true',
+                        )
+                );
+
+                // Prevent a bunch of noisy or unstable data from being included in the test output.
+                wp_scripts()->registered['wp-api-fetch']->ver            = 'test';
+                wp_scripts()->registered['wp-api-fetch']->extra['after'] = array();
+
+                block_editor_rest_api_preload(
+                        array( '/test/v0/test-62797' ),
+                        new WP_Block_Editor_Context()
+                );
+
+                ob_start();
+                wp_scripts()->do_item( 'wp-api-fetch' );
+                $output = ob_get_clean();
+
+                $baseurl  = site_url();
+                $expected = <<<HTML
+<script src="{$baseurl}/wp-includes/js/dist/api-fetch.min.js?ver=test" id="wp-api-fetch-js"></script>
+<script id="wp-api-fetch-js-after">
+wp.apiFetch.use( wp.apiFetch.createPreloadingMiddleware( {"/test/v0/test-62797":{"body":["Unclosed comment and a script open tag \\u003C!--\\u003Cscript\\u003E"],"headers":{"Allow":"GET"}}} ) );
+</script>
+
+HTML;
+                $this->assertEqualHTML( $expected, $output );
         }
 }