Changeset 60681 for trunk/src/wp-includes/theme-previews.php

Timestamp:

08/27/2025 10:32:57 AM (13 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/src/wp-includes/theme-previews.php (modified) (2 diffs)

trunk/src/wp-includes/theme-previews.php

@@ -50 +50 @@
                 sprintf(
                         'wp.apiFetch.use( wp.apiFetch.createThemePreviewMiddleware( %s ) );',
-                        wp_json_encode( sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ) )
+                        wp_json_encode( sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
                 ),
                 'after'
@@ -71 +71 @@
         ?>
         <script type="text/javascript">
-                window.WP_BLOCK_THEME_ACTIVATE_NONCE = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ) ); ?>;
+                window.WP_BLOCK_THEME_ACTIVATE_NONCE = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
         </script>
         <?php