Changeset 60649 for trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

Timestamp:

08/19/2025 07:07:11 PM (11 months ago)

Author:

jonsurrell

Message:

HTML API: Improve script tag escape state processing.

Addresses some edge cases parsing of script tag contents:

• "<!-->" remains in the unescaped state and does not enter the escaped state.
• Contents in the escaped state that end with "<script" do not enter double-escaped state.
• "\f" (Form Feed) was missing as a tag name terminating character.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9397 and ​https://github.com/WordPress/wordpress-develop/pull/9402.

Props jonsurrell, dmsnell.
See #63738.

File:

• trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (2 diffs)

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -1557 +1557 @@
 
                         /*
-                         * Unlike with "-->", the "<!--" only transitions
-                         * into the escaped mode if not already there.
-                         *
-                         * Inside the escaped modes it will be ignored; and
-                         * should never break out of the double-escaped
-                         * mode and back into the escaped mode.
-                         *
-                         * While this requires a mode change, it does not
-                         * impact the parsing otherwise, so continue
-                         * parsing after updating the state.
+                         * "<!--" only transitions from _unescaped_ to _escaped_. This byte sequence is only
+                         * significant in the _unescaped_ state and is ignored in any other state.
                          */
                         if (
+                                'unescaped' === $state &&
                                 '!' === $html[ $at ] &&
                                 '-' === $html[ $at + 1 ] &&
                                 '-' === $html[ $at + 2 ]
                         ) {
-                                $at   += 3;
-                                $state = 'unescaped' === $state ? 'escaped' : $state;
+                                $at += 3;
+
+                                /*
+                                 * The parser is ready to enter the _escaped_ state, but may remain in the
+                                 * _unescaped_ state. This occurs when "<!--" is immediately followed by a
+                                 * sequence of 0 or more "-" followed by ">". This is similar to abruptly closed
+                                 * HTML comments like "<!-->" or "<!--->".
+                                 *
+                                 * Note that this check may advance the position significantly and requires a
+                                 * length check to prevent bad offsets on inputs like `<script><!---------`.
+                                 */
+                                $at += strspn( $html, '-', $at );
+                                if ( $at < $doc_length && '>' === $html[ $at ] ) {
+                                        ++$at;
+                                        continue;
+                                }
+
+                                $state = 'escaped';
                                 continue;
                         }
@@ -1611 +1620 @@
                         $at += 6;
                         $c   = $html[ $at ];
-                        if ( ' ' !== $c && "\t" !== $c && "\r" !== $c && "\n" !== $c && '/' !== $c && '>' !== $c ) {
-                                ++$at;
+                        if (
+                                /**
+                                 * These characters trigger state transitions of interest:
+                                 *
+                                 * - @see {https://html.spec.whatwg.org/multipage/parsing.html#script-data-end-tag-name-state}
+                                 * - @see {https://html.spec.whatwg.org/multipage/parsing.html#script-data-escaped-end-tag-name-state}
+                                 * - @see {https://html.spec.whatwg.org/multipage/parsing.html#script-data-double-escape-start-state}
+                                 * - @see {https://html.spec.whatwg.org/multipage/parsing.html#script-data-double-escape-end-state}
+                                 *
+                                 * The "\r" character is not present in the above references. However, "\r" must be
+                                 * treated the same as "\n". This is because the HTML Standard requires newline
+                                 * normalization during preprocessing which applies this replacement.
+                                 *
+                                 * - @see https://html.spec.whatwg.org/multipage/parsing.html#preprocessing-the-input-stream
+                                 * - @see https://infra.spec.whatwg.org/#normalize-newlines
+                                 */
+                                '>' !== $c &&
+                                ' ' !== $c &&
+                                "\n" !== $c &&
+                                '/' !== $c &&
+                                "\t" !== $c &&
+                                "\f" !== $c &&
+                                "\r" !== $c
+                        ) {
                                 continue;
                         }