WordPress.org
Get WordPress

Make WordPress Core

Changeset 60681


Ignore:
Timestamp:
08/27/2025 10:32:57 AM (8 weeks ago)
Author:
jonsurrell
Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

Location:
trunk
Files:
36 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/wp-admin/async-upload.php

    r60637 r60681  
    146146    );
    147147
    148     echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
     148    echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
    149149    exit;
    150150}

  • trunk/src/wp-admin/customize.php

    r59945 r60681  
    6363        <?php wp_print_scripts( array( 'wp-util' ) ); ?>
    6464        <script>
    65             wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args ); ?> );
     65            wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
    6666        </script>
    6767        <?php
    … …  
    159159
    160160<script type="text/javascript">
    161 var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ) ); ?>,
     161var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>,
    162162    pagenow = 'customize';
    163163</script>

  • trunk/src/wp-admin/edit-form-blocks.php

    r59958 r60681  
    116116wp_add_inline_script(
    117117    'wp-blocks',
    118     sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ) ) ),
     118    sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
    119119    'after'
    120120);
    … …  
    145145wp_add_inline_script(
    146146    'wp-blocks',
    147     'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
     147    'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
    148148);
    149149
    … …  
    159159        );
    160160    }
    161     $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
     161    $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
    162162    wp_add_inline_script(
    163163        'wp-blocks',
    … …  
    179179wp_add_inline_script(
    180180    'wp-editor',
    181     sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url ) ),
     181    sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
    182182    'before'
    183183);
    … …  
    365365    $post->post_type,
    366366    $post->ID,
    367     wp_json_encode( $editor_settings ),
    368     wp_json_encode( $initial_edits )
     367    wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     368    wp_json_encode( $initial_edits, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    369369);
    370370wp_add_inline_script( 'wp-edit-post', $script );

  • trunk/src/wp-admin/includes/class-wp-internal-pointers.php

    r55916 r60681  
    121121        <script type="text/javascript">
    122122        (function($){
    123             var options = <?php echo wp_json_encode( $args ); ?>, setup;
     123            var options = <?php echo wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>, setup;
    124124
    125125            if ( ! options )

  • trunk/src/wp-admin/includes/class-wp-list-table.php

    r60613 r60681  
    18721872        );
    18731873
    1874         printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args ) );
     1874        printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
    18751875    }
    18761876}

  • trunk/src/wp-admin/includes/class-wp-privacy-policy-content.php

    r59733 r60681  
    349349                    'wp.data.dispatch( "core/notices" ).createWarningNotice( "%s", { actions: [ %s ], isDismissible: false } )',
    350350                    $message,
    351                     wp_json_encode( $action )
     351                    wp_json_encode( $action, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    352352                ),
    353353                'after'

  • trunk/src/wp-admin/includes/class-wp-themes-list-table.php

    r59675 r60681  
    358358        }
    359359
    360         printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args ) );
     360        printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
    361361        parent::_js_vars();
    362362    }

  • trunk/src/wp-admin/includes/media.php

    r60449 r60681  
    275275    <script type="text/javascript">
    276276    var win = window.dialogArguments || opener || parent || top;
    277     win.send_to_editor( <?php echo wp_json_encode( $html ); ?> );
     277    win.send_to_editor( <?php echo wp_json_encode( $html, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
    278278    </script>
    279279    <?php
    … …  
    22372237    ?>
    22382238    var resize_height = <?php echo $large_size_h; ?>, resize_width = <?php echo $large_size_w; ?>,
    2239     wpUploaderInit = <?php echo wp_json_encode( $plupload_init ); ?>;
     2239    wpUploaderInit = <?php echo wp_json_encode( $plupload_init, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
    22402240    </script>
    22412241

  • trunk/src/wp-admin/includes/misc.php

    r60658 r60681  
    10861086    }
    10871087
    1088     echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ) ) . ";</script>\n";
     1088    echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ";</script>\n";
    10891089}
    10901090

  • trunk/src/wp-admin/includes/options.php

    r57713 r60681  
    3838        var $siteName = $( '#wp-admin-bar-site-name' ).children( 'a' ).first(),
    3939            $siteIconPreview = $('#site-icon-preview-site-title'),
    40             homeURL = ( <?php echo wp_json_encode( get_home_url() ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );
     40            homeURL = ( <?php echo wp_json_encode( get_home_url(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );
    4141
    4242        $( '#blogname' ).on( 'input', function() {

  • trunk/src/wp-admin/includes/post.php

    r60275 r60681  
    24432443     */
    24442444    $script = 'window._wpLoadBlockEditor.then( function() {
    2445         wp.data.dispatch( \'core/edit-post\' ).setAvailableMetaBoxesPerLocation( ' . wp_json_encode( $meta_boxes_per_location ) . ' );
     2445        wp.data.dispatch( \'core/edit-post\' ).setAvailableMetaBoxesPerLocation( ' . wp_json_encode( $meta_boxes_per_location, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ' );
    24462446    } );';
    24472447

  • trunk/src/wp-admin/includes/template.php

    r60658 r60681  
    24802480    ?>
    24812481    <script type="text/javascript">
    2482     var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ) ); ?>;
     2482    var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
    24832483    var testCompression = {
    24842484        get : function(test) {

  • trunk/src/wp-admin/plugin-editor.php

    r60479 r60681  
    161161);
    162162wp_enqueue_script( 'wp-theme-plugin-editor' );
    163 wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings ) ) );
     163wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
    164164wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'wp.themePluginEditor.themeOrPlugin = "plugin";' ) );
    165165

  • trunk/src/wp-admin/site-editor.php

    r60134 r60681  
    258258            wp.editSite.initializeEditor( "site-editor", %s );
    259259        } );',
    260         wp_json_encode( $editor_settings )
     260        wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    261261    )
    262262);
    … …  
    265265wp_add_inline_script(
    266266    'wp-blocks',
    267     'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
     267    'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
    268268);
    269269
    … …  
    279279        );
    280280    }
    281     $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
     281    $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
    282282    wp_add_inline_script(
    283283        'wp-blocks',
    … …  
    288288wp_add_inline_script(
    289289    'wp-blocks',
    290     sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( isset( $editor_settings['blockCategories'] ) ? $editor_settings['blockCategories'] : array() ) ),
     290    sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( isset( $editor_settings['blockCategories'] ) ? $editor_settings['blockCategories'] : array(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
    291291    'after'
    292292);

  • trunk/src/wp-admin/theme-editor.php

    r59884 r60681  
    147147);
    148148wp_enqueue_script( 'wp-theme-plugin-editor' );
    149 wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings ) ) );
     149wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
    150150wp_add_inline_script( 'wp-theme-plugin-editor', 'wp.themePluginEditor.themeOrPlugin = "theme";' );
    151151

  • trunk/src/wp-admin/widgets-form-blocks.php

    r59238 r60681  
    4242            wp.editWidgets.initialize( "widgets-editor", %s );
    4343        } );',
    44         wp_json_encode( $editor_settings )
     44        wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    4545    )
    4646);
    … …  
    4949wp_add_inline_script(
    5050    'wp-blocks',
    51     'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
     51    'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
    5252);
    5353
    … …  
    6363        );
    6464    }
    65     $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
     65    $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
    6666    wp_add_inline_script(
    6767        'wp-blocks',
    … …  
    7272wp_add_inline_script(
    7373    'wp-blocks',
    74     sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
     74    sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
    7575    'after'
    7676);

  • trunk/src/wp-content/themes/twentytwenty/functions.php

    r60536 r60681  
    685685        sprintf(
    686686            'wp.customize.selectiveRefresh.partialConstructor[ %1$s ].prototype.attrs = %2$s;',
    687             wp_json_encode( 'cover_opacity' ),
    688             wp_json_encode( twentytwenty_customize_opacity_range() )
     687            wp_json_encode( 'cover_opacity', JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     688            wp_json_encode( twentytwenty_customize_opacity_range(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    689689        )
    690690    );

  • trunk/src/wp-includes/class-wp-customize-manager.php

    r60522 r60681  
    477477                var preview = new api.Messenger( settings.messengerArgs );
    478478                preview.send( 'iframe-loading-error', settings.error );
    479             } )( wp.customize, <?php echo wp_json_encode( $settings ); ?> );
     479            } )( wp.customize, <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
    480480            </script>
    481481            <?php
    … …  
    22062206        ?>
    22072207        <script>
    2208             var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
     2208            var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
    22092209            _wpCustomizeSettings.values = {};
    22102210            (function( v ) {
    … …  
    22192219                        printf(
    22202220                            "v[%s] = %s;\n",
    2221                             wp_json_encode( $id ),
    2222                             wp_json_encode( $setting->js_value() )
     2221                            wp_json_encode( $id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     2222                            wp_json_encode( $setting->js_value(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    22232223                        );
    22242224                    }
    … …  
    49894989        ?>
    49904990        <script>
    4991             var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
     4991            var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
    49924992            _wpCustomizeSettings.initialClientTimestamp = _.now();
    49934993            _wpCustomizeSettings.controls = {};
    … …  
    50015001                    printf(
    50025002                        "s[%s] = %s;\n",
    5003                         wp_json_encode( $setting->id ),
    5004                         wp_json_encode( $setting->json() )
     5003                        wp_json_encode( $setting->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     5004                        wp_json_encode( $setting->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    50055005                    );
    50065006                }
    … …  
    50145014                    printf(
    50155015                        "c[%s] = %s;\n",
    5016                         wp_json_encode( $control->id ),
    5017                         wp_json_encode( $control->json() )
     5016                        wp_json_encode( $control->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     5017                        wp_json_encode( $control->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    50185018                    );
    50195019                }

  • trunk/src/wp-includes/class-wp-customize-nav-menus.php

    r59948 r60681  
    546546        );
    547547
    548         $data = sprintf( 'var _wpCustomizeNavMenusSettings = %s;', wp_json_encode( $settings ) );
     548        $data = sprintf( 'var _wpCustomizeNavMenusSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
    549549        wp_scripts()->add_data( 'customize-nav-menus', 'data', $data );
    550550
    … …  
    15491549            'navMenuInstanceArgs' => $this->preview_nav_menu_instance_args,
    15501550        );
    1551         wp_print_inline_script_tag( sprintf( 'var _wpCustomizePreviewNavMenusExports = %s;', wp_json_encode( $exports ) ) );
     1551        wp_print_inline_script_tag( sprintf( 'var _wpCustomizePreviewNavMenusExports = %s;', wp_json_encode( $exports, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
    15521552    }
    15531553

  • trunk/src/wp-includes/class-wp-customize-widgets.php

    r60290 r60681  
    833833            'customize-widgets',
    834834            'data',
    835             sprintf( 'var _wpCustomizeWidgetsSettings = %s;', wp_json_encode( $settings ) )
     835            sprintf( 'var _wpCustomizeWidgetsSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
    836836        );
    837837
    … …  
    860860                       wp.customizeWidgets.initialize( "widgets-customizer", %s );
    861861                    } );',
    862                     wp_json_encode( $editor_settings )
     862                    wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    863863                )
    864864            );
    … …  
    867867            wp_add_inline_script(
    868868                'wp-blocks',
    869                 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
     869                'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
    870870            );
    871871
    … …  
    881881                    );
    882882                }
    883                 $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
     883                $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
    884884                wp_add_inline_script(
    885885                    'wp-blocks',
    … …  
    890890            wp_add_inline_script(
    891891                'wp-blocks',
    892                 sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
     892                sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
    893893                'after'
    894894            );
    … …  
    13351335        }
    13361336        wp_print_inline_script_tag(
    1337             sprintf( 'var _wpWidgetCustomizerPreviewSettings = %s;', wp_json_encode( $settings ) )
     1337            sprintf( 'var _wpWidgetCustomizerPreviewSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
    13381338        );
    13391339    }

  • trunk/src/wp-includes/class-wp-script-modules.php

    r59505 r60681  
    249249        if ( ! empty( $import_map['imports'] ) ) {
    250250            wp_print_inline_script_tag(
    251                 wp_json_encode( $import_map, JSON_HEX_TAG | JSON_HEX_AMP ),
     251                wp_json_encode( $import_map, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
    252252                array(
    253253                    'type' => 'importmap',

  • trunk/src/wp-includes/class-wp-scripts.php

    r58878 r60681  
    597597        }
    598598
    599         $script = "var $object_name = " . wp_json_encode( $l10n ) . ';';
     599        $script = "var $object_name = " . wp_json_encode( $l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';
    600600
    601601        if ( ! empty( $after ) ) {

  • trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php

    r56687 r60681  
    194194
    195195        // Export data to JS.
    196         wp_print_inline_script_tag( sprintf( 'var _customizePartialRefreshExports = %s;', wp_json_encode( $exports ) ) );
     196        wp_print_inline_script_tag( sprintf( 'var _customizePartialRefreshExports = %s;', wp_json_encode( $exports, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
    197197    }
    198198

  • trunk/src/wp-includes/general-template.php

    r60331 r60681  
    40674067    }
    40684068
    4069     wp_add_inline_script( 'code-editor', sprintf( 'jQuery.extend( wp.codeEditor.defaultSettings, %s );', wp_json_encode( $settings ) ) );
     4069    wp_add_inline_script( 'code-editor', sprintf( 'jQuery.extend( wp.codeEditor.defaultSettings, %s );', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
    40704070
    40714071    /**

  • trunk/src/wp-includes/media.php

    r60678 r60681  
    32753275    </ol>
    32763276    </noscript>
    3277     <script type="application/json" class="wp-playlist-script"><?php echo wp_json_encode( $data ); ?></script>
     3277    <script type="application/json" class="wp-playlist-script"><?php echo wp_json_encode( $data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?></script>
    32783278</div>
    32793279    <?php
    … …  
    44364436    );
    44374437
    4438     $script = 'var _wpPluploadSettings = ' . wp_json_encode( $settings ) . ';';
     4438    $script = 'var _wpPluploadSettings = ' . wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';
    44394439
    44404440    if ( $data ) {

  • trunk/src/wp-includes/script-loader.php

    r60522 r60681  
    160160                        'LLLL' => null,
    161161                    ),
    162                 )
     162                ),
     163                JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
    163164            )
    164165        ),
    … …  
    385386                wp.data.dispatch( preferencesStore ).setPersistenceLayer( persistenceLayer );
    386387            } ) ();',
    387             wp_json_encode( $preload_data ),
     388            wp_json_encode( $preload_data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
    388389            $user_id
    389390        )
    … …  
    478479                        'abbr'            => $timezone_abbr,
    479480                    ),
    480                 )
     481                ),
     482                JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
    481483            )
    482484        ),
    … …  
    641643    $script = 'window.wpEditorL10n = {
    642644        tinymce: {
    643             baseURL: ' . wp_json_encode( includes_url( 'js/tinymce' ) ) . ',
     645            baseURL: ' . wp_json_encode( includes_url( 'js/tinymce' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ',
    644646            suffix: ' . ( SCRIPT_DEBUG ? '""' : '".min"' ) . ',
    645647            settings: ' . $init_obj . ',
    … …  
    11561158                        'mejs.yiddish'             => __( 'Yiddish' ),
    11571159                    ),
    1158                 )
     1160                ),
     1161                JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
    11591162            )
    11601163        ),
    … …  
    20002003            'firstDay'        => absint( get_option( 'start_of_week' ) ),
    20012004            'isRTL'           => $wp_locale->is_rtl(),
    2002         )
     2005        ),
     2006        JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
    20032007    );
    20042008
    … …  
    28102814                '   wp.blocks.registerBlockStyle( \'%s\', %s );',
    28112815                $block_name,
    2812                 wp_json_encode( $block_style )
     2816                wp_json_encode( $block_style, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    28132817            );
    28142818        }

  • trunk/src/wp-includes/speculative-loading.php

    r59881 r60681  
    248248    wp_print_inline_script_tag(
    249249        (string) wp_json_encode(
    250             $speculation_rules
     250            $speculation_rules,
     251            JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
    251252        ),
    252253        array( 'type' => 'speculationrules' )

  • trunk/src/wp-includes/theme-previews.php

    r57171 r60681  
    5050        sprintf(
    5151            'wp.apiFetch.use( wp.apiFetch.createThemePreviewMiddleware( %s ) );',
    52             wp_json_encode( sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ) )
     52            wp_json_encode( sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    5353        ),
    5454        'after'
    … …  
    7171    ?>
    7272    <script type="text/javascript">
    73         window.WP_BLOCK_THEME_ACTIVATE_NONCE = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ) ); ?>;
     73        window.WP_BLOCK_THEME_ACTIVATE_NONCE = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
    7474    </script>
    7575    <?php

  • trunk/src/wp-includes/theme.php

    r60499 r60681  
    37493749    );
    37503750
    3751     $script = 'var _wpCustomizeLoaderSettings = ' . wp_json_encode( $settings ) . ';';
     3751    $script = 'var _wpCustomizeLoaderSettings = ' . wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';
    37523752
    37533753    $wp_scripts = wp_scripts();

  • trunk/src/wp-includes/widgets/class-wp-widget-custom-html.php

    r59120 r60681  
    216216
    217217        wp_enqueue_script( 'custom-html-widgets' );
    218         wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.idBases.push( %s );', wp_json_encode( $this->id_base ) ) );
     218        wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.idBases.push( %s );', wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
    219219
    220220        if ( empty( $settings ) ) {
    … …  
    223223            );
    224224        }
    225         wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.init( %s );', wp_json_encode( $settings ) ), 'after' );
     225        wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.init( %s );', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ), 'after' );
    226226
    227227        $l10n = array(
    … …  
    234234            ),
    235235        );
    236         wp_add_inline_script( 'custom-html-widgets', sprintf( 'jQuery.extend( wp.customHtmlWidgets.l10n, %s );', wp_json_encode( $l10n ) ), 'after' );
     236        wp_add_inline_script( 'custom-html-widgets', sprintf( 'jQuery.extend( wp.customHtmlWidgets.l10n, %s );', wp_json_encode( $l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ), 'after' );
    237237    }
    238238

  • trunk/src/wp-includes/widgets/class-wp-widget-media-audio.php

    r56597 r60681  
    161161            sprintf(
    162162                'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
    163                 wp_json_encode( $this->id_base ),
    164                 wp_json_encode( $exported_schema )
     163                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     164                wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    165165            )
    166166        );
    … …  
    173173                    wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n = _.extend( {}, wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
    174174                ',
    175                 wp_json_encode( $this->id_base ),
    176                 wp_json_encode( $this->widget_options['mime_type'] ),
    177                 wp_json_encode( $this->l10n )
     175                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     176                wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     177                wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    178178            )
    179179        );

  • trunk/src/wp-includes/widgets/class-wp-widget-media-gallery.php

    r60325 r60681  
    149149            sprintf(
    150150                'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
    151                 wp_json_encode( $this->id_base ),
    152                 wp_json_encode( $exported_schema )
     151                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     152                wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    153153            )
    154154        );
    … …  
    161161                    _.extend( wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
    162162                ',
    163                 wp_json_encode( $this->id_base ),
    164                 wp_json_encode( $this->widget_options['mime_type'] ),
    165                 wp_json_encode( $this->l10n )
     163                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     164                wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     165                wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    166166            )
    167167        );

  • trunk/src/wp-includes/widgets/class-wp-widget-media-image.php

    r59120 r60681  
    324324            sprintf(
    325325                'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
    326                 wp_json_encode( $this->id_base ),
    327                 wp_json_encode( $exported_schema )
     326                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     327                wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    328328            )
    329329        );
    … …  
    336336                    wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n = _.extend( {}, wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
    337337                ',
    338                 wp_json_encode( $this->id_base ),
    339                 wp_json_encode( $this->widget_options['mime_type'] ),
    340                 wp_json_encode( $this->l10n )
     338                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     339                wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     340                wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    341341            )
    342342        );

  • trunk/src/wp-includes/widgets/class-wp-widget-media-video.php

    r56597 r60681  
    200200            sprintf(
    201201                'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
    202                 wp_json_encode( $this->id_base ),
    203                 wp_json_encode( $exported_schema )
     202                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     203                wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    204204            )
    205205        );
    … …  
    212212                    wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n = _.extend( {}, wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
    213213                ',
    214                 wp_json_encode( $this->id_base ),
    215                 wp_json_encode( $this->widget_options['mime_type'] ),
    216                 wp_json_encode( $this->l10n )
     214                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     215                wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
     216                wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
    217217            )
    218218        );

  • trunk/src/wp-includes/widgets/class-wp-widget-text.php

    r59696 r60681  
    436436        wp_enqueue_media();
    437437        wp_enqueue_script( 'text-widgets' );
    438         wp_add_inline_script( 'text-widgets', sprintf( 'wp.textWidgets.idBases.push( %s );', wp_json_encode( $this->id_base ) ) );
     438        wp_add_inline_script( 'text-widgets', sprintf( 'wp.textWidgets.idBases.push( %s );', wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
    439439        wp_add_inline_script( 'text-widgets', 'wp.textWidgets.init();', 'after' );
    440440    }

  • trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php

    r58068 r60681  
    44 * @group scripts
    55 */
    6 class Tests_Dependencies_LocalizeScript extends WP_UnitTestCase {
     6class Tests_Dependencies_wpLocalizeScript extends WP_UnitTestCase {
    77    /**
    88     * @var WP_Scripts
    … …  
    3939        );
    4040    }
     41
     42    /**
     43     * Verifies that wp_localize_script() outputs safe JSON whe harmful data is provided.
     44     *
     45     * @ticket 63851
     46     * @covers ::wp_localize_script
     47     */
     48    public function test_wp_localize_script_outputs_safe_json() {
     49        add_theme_support( 'html5', array( 'script' ) );
     50
     51        $path     = '/test.js';
     52        $base_url = site_url( $path );
     53
     54        wp_enqueue_script( 'test-script', $path, array(), null );
     55        wp_localize_script( 'test-script', 'testData', array( '<!--' => '<script>' ) );
     56
     57        $output = get_echo( 'wp_print_scripts' );
     58
     59        $expected  = "<script id=\"test-script-js-extra\">\nvar testData = {\"\\u003C!--\":\"\\u003Cscript\\u003E\"};\n</script>\n";
     60        $expected .= "<script src=\"{$base_url}\" id=\"test-script-js\"></script>\n";
     61
     62        $this->assertEqualHTML( $expected, $output );
     63    }
    4164}
Note: See TracChangeset for help on using the changeset viewer.