Changeset 61418 for trunk/src/wp-includes/theme.php

Timestamp:

12/30/2025 01:01:11 PM (2 months ago)

Author:

jonsurrell

Message:

Use the HTML API to generate style tags.

The HTML API escapes <style> tag contents to ensure the correct HTML structure. Common HTML escaping is unsuitable for <style> tags because they contain "raw text." The additional safety allows other restrictions, such as rejecting content with <>, to be relaxed or removed because the resulting tag will be well-formed.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/10656.

Props jonsurrell, westonruter, dmsnell, ramonopoly, soyebsalar01, drw158, sabernhardt.
See #64418.

File:

• trunk/src/wp-includes/theme.php (modified) (2 diffs)

trunk/src/wp-includes/theme.php

@@ -1951 +1951 @@
         $style .= $image . $position . $size . $repeat . $attachment;
     }
-    ?>
-<style<?php echo $type_attr; ?> id="custom-background-css">
-body.custom-background { <?php echo trim( $style ); ?> }
-</style>
-    <?php
+
+    $processor = new WP_HTML_Tag_Processor( "<style{$type_attr} id=\"custom-background-css\"></style>" );
+    $processor->next_tag();
+
+    $style_tag_content = 'body.custom-background { ' . trim( $style ) . ' }';
+    $processor->set_modifiable_text( "\n{$style_tag_content}\n" );
+    echo "{$processor->get_updated_html()}\n";
 }
 
@@ -1965 +1967 @@
 function wp_custom_css_cb() {
     $styles = wp_get_custom_css();
-    if ( $styles || is_customize_preview() ) :
-        $type_attr = current_theme_supports( 'html5', 'style' ) ? '' : ' type="text/css"';
-        ?>
-        <style<?php echo $type_attr; ?> id="wp-custom-css">
-            <?php
-            // Note that esc_html() cannot be used because `div &gt; span` is not interpreted properly.
-            echo strip_tags( $styles );
-            ?>
-        </style>
-        <?php
-    endif;
+    if ( ! $styles && ! is_customize_preview() ) {
+        return;
+    }
+
+    $processor = new WP_HTML_Tag_Processor( '<style></style>' );
+    $processor->next_tag();
+    if ( ! current_theme_supports( 'html5', 'style' ) ) {
+        $processor->set_attribute( 'type', 'text/css' );
+    }
+    $processor->set_attribute( 'id', 'wp-custom-css' );
+    $processor->set_modifiable_text( "\n{$styles}\n" );
+    echo "{$processor->get_updated_html()}\n";
 }