Changeset 60681 for trunk/src/wp-includes/media.php

Timestamp:

08/27/2025 10:32:57 AM (8 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/src/wp-includes/media.php (modified) (2 diffs)

trunk/src/wp-includes/media.php

@@ -3275 +3275 @@
     </ol>
     </noscript>
-    <script type="application/json" class="wp-playlist-script"><?php echo wp_json_encode( $data ); ?></script>
+    <script type="application/json" class="wp-playlist-script"><?php echo wp_json_encode( $data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?></script>
 </div>
     <?php
@@ -4436 +4436 @@
     );
 
-    $script = 'var _wpPluploadSettings = ' . wp_json_encode( $settings ) . ';';
+    $script = 'var _wpPluploadSettings = ' . wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';
 
     if ( $data ) {