Changeset 60681 for trunk/src/wp-includes/script-loader.php

Timestamp:

08/27/2025 10:32:57 AM (4 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/src/wp-includes/script-loader.php (modified) (7 diffs)

trunk/src/wp-includes/script-loader.php

@@ -160 +160 @@
                         'LLLL' => null,
                     ),
-                )
+                ),
+                JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
             )
         ),
@@ -385 +386 @@
                 wp.data.dispatch( preferencesStore ).setPersistenceLayer( persistenceLayer );
             } ) ();',
-            wp_json_encode( $preload_data ),
+            wp_json_encode( $preload_data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
             $user_id
         )
@@ -478 +479 @@
                         'abbr'            => $timezone_abbr,
                     ),
-                )
+                ),
+                JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
             )
         ),
@@ -641 +643 @@
     $script = 'window.wpEditorL10n = {
         tinymce: {
-            baseURL: ' . wp_json_encode( includes_url( 'js/tinymce' ) ) . ',
+            baseURL: ' . wp_json_encode( includes_url( 'js/tinymce' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ',
             suffix: ' . ( SCRIPT_DEBUG ? '""' : '".min"' ) . ',
             settings: ' . $init_obj . ',
@@ -1156 +1158 @@
                         'mejs.yiddish'             => __( 'Yiddish' ),
                     ),
-                )
+                ),
+                JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
             )
         ),
@@ -2000 +2003 @@
             'firstDay'        => absint( get_option( 'start_of_week' ) ),
             'isRTL'           => $wp_locale->is_rtl(),
-        )
+        ),
+        JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
     );
 
@@ -2810 +2814 @@
                 '   wp.blocks.registerBlockStyle( \'%s\', %s );',
                 $block_name,
-                wp_json_encode( $block_style )
+                wp_json_encode( $block_style, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
             );
         }