Changeset 61485 for trunk/tests/phpunit/tests/dependencies/wpInlineScriptTag.php

Timestamp:

01/15/2026 11:11:45 AM (8 weeks ago)

Author:

jonsurrell

Message:

Script Loader: Use HTML API to generate SCRIPT tags.

Script tags have complicated and unintuitive parsing rules that make them difficult to author correctly. The HTML API automatically escapes script tag contents as necessary and will set attributes correctly. Using the HTML API to generate SCRIPT tags improves safety when working with SCRIPT tags, resolving a class of issues that have manifested repeatedly.

Changeset [61418] applied the HTML API to generate style tags in a similar way.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/10639.

Props jonsurrell, dmsnell, westonruter.
Fixes #64500. See #64419, #40737, #62797, #63851, #51159.

File:

• trunk/tests/phpunit/tests/dependencies/wpInlineScriptTag.php (modified) (1 diff)

trunk/tests/phpunit/tests/dependencies/wpInlineScriptTag.php

@@ -165 +165 @@
         );
     }
+
+    /**
+     * Test failure conditions setting inline script tag contents.
+     *
+     * @ticket 64500
+     */
+    public function test_script_tag_dangerous_unescapeable_contents() {
+        $this->setExpectedIncorrectUsage( 'wp_get_inline_script_tag' );
+        /*
+         * </script> cannot be printed inside a script tag
+         * the `example/example` type is an unknown type with no known escaping rules.
+         * The only choice is to abort.
+         */
+        $result = wp_get_inline_script_tag(
+            '</script>',
+            array( 'type' => 'example/example' )
+        );
+        $this->assertSame( '', $result );
+    }
 }