Context Navigation

Changeset 60887

Timestamp:

10/01/2025 12:57:19 PM (10 months ago)

Author:

jonsurrell

Message:

HTML API: Ensure non-string HTML input is safely handled.

Prevents an issue where passing null to HTML API constructors could result in runtime errors.

Props kraftbj, jonsurrell, westonruter.
Fixes #63854.

Location:

trunk

Files:

-              r60647
+              r60887
+                }
+                if ( ! is_string( $html ) ) {
+                        _doing_it_wrong(
+                                __METHOD__,
+                                __( 'The HTML parameter must be a string.' ),
+                                '6.9.0'
+                        );
+                        return null;
+                }
                 $context_processor = static::create_full_parser( "<!DOCTYPE html>{$context}", $encoding );
                 if ( null === $context_processor ) {
 …
         public static function create_full_parser( $html, $known_definite_encoding = 'UTF-8' ) {
                 if ( 'UTF-8' !== $known_definite_encoding ) {
+                        return null;
+                }
+                if ( ! is_string( $html ) ) {
+                        _doing_it_wrong(
+                                __METHOD__,
+                                __( 'The HTML parameter must be a string.' ),
+                                '6.9.0'
+                        );
                         return null;
+                }

-              r60706
+              r60887
          */
         public function __construct( $html ) {
+                if ( ! is_string( $html ) ) {
+                        _doing_it_wrong(
+                                __METHOD__,
+                                __( 'The HTML parameter must be a string.' ),
+                                '6.9.0'
+                        );
+                        $html = '';
+                }
                 $this->html = $html;
+        }

-              r59467
+              r60887
         public function test_warns_that_the_static_creator_methods_should_be_called_instead_of_the_public_constructor() {
                 new WP_HTML_Processor( '<p>Light roast.</p>' );
+        }
+        /**
+         * @ticket 63854
+         *
+         * @covers ::create_fragment
+         * @expectedIncorrectUsage WP_HTML_Processor::create_fragment
+         */
+        public function test_create_fragment_validates_html_parameter() {
+                $processor = WP_HTML_Processor::create_fragment( null );
+                $this->assertNull( $processor );
+        }
+        /**
+         * @ticket 63854
+         *
+         * @covers ::create_full_parser
+         * @expectedIncorrectUsage WP_HTML_Processor::create_full_parser
+         */
+        public function test_create_full_parser_validates_html_parameter() {
+                $processor = WP_HTML_Processor::create_full_parser( null );
+                $this->assertNull( $processor );
+        }

-              r60649
+              r60887
                         $this->assertFalse( $processor->has_self_closing_flag(), 'Found the self-closing tag when it was absent.' );
+                }
+        }
+        /**
+         * @ticket 63854
+         *
+         * @covers WP_HTML_Tag_Processor::__construct
+         * @expectedIncorrectUsage WP_HTML_Tag_Processor::__construct
+         */
+        public function test_constructor_validates_html_parameter() {
+                // Test that passing null triggers _doing_it_wrong and sets HTML to empty string.
+                $processor = new WP_HTML_Tag_Processor( null );
+                // Verify that the HTML was set to an empty string.
+                $this->assertSame( '', $processor->get_updated_html(), 'HTML should be set to empty string when null is passed' );
+                // Verify that next_token() works without errors (indicating the processor is in a valid state).
+                $this->assertFalse( $processor->next_token(), 'next_token() should work without errors when HTML is empty string' );
+        }

Note: See TracChangeset for help on using the changeset viewer.