Changeset 60681 for trunk/src/wp-includes/widgets/class-wp-widget-media-image.php

Timestamp:

08/27/2025 10:32:57 AM (6 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/src/wp-includes/widgets/class-wp-widget-media-image.php (modified) (2 diffs)

trunk/src/wp-includes/widgets/class-wp-widget-media-image.php

@@ -324 +324 @@
             sprintf(
                 'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
-                wp_json_encode( $this->id_base ),
-                wp_json_encode( $exported_schema )
+                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+                wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
             )
         );
@@ -336 +336 @@
                     wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n = _.extend( {}, wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
                 ',
-                wp_json_encode( $this->id_base ),
-                wp_json_encode( $this->widget_options['mime_type'] ),
-                wp_json_encode( $this->l10n )
+                wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+                wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+                wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
             )
         );