Changeset 62492

Timestamp:

06/11/2026 10:17:13 PM (2 months ago)

Author:

dmsnell

Message:

HTML API: preserve adjusted foreign attributes on serialization.

Discovered during fuzz-testing of the HTML API. Adjusted foreign attributes, such as xlink:href, were being normalized with a space instead of a colon through ::serialize_token(). This led to the creation of two attributes on output instead of the proper singular attribute.

This patch corrects the issue by ensuring that the attribute namespace and name are separated by a colon when serializing.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12140
Discussed in: https://core.trac.wordpress.org/ticket/65372

Props jonsurrell.
See #65372.

Location:

trunk

Files:

• src/wp-includes/html-api/class-wp-html-processor.php (modified) (2 diffs)
• src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)
• tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php (modified) (1 diff)

trunk/src/wp-includes/html-api/class-wp-html-processor.php

@@ -1429 +1429 @@
                         $qualified_attribute_name = str_replace( "\x00", "\u{FFFD}", $qualified_attribute_name );
                         $qualified_attribute_name = wp_scrub_utf8( $qualified_attribute_name );
+                        /**
+                         * Spaces only appear via the foreign attribute adjustment table.
+                         * @see WP_HTML_Tag_Processor::get_qualified_attribute_name()
+                         */
+                        $serialized_attribute_name = str_replace( ' ', ':', $qualified_attribute_name );
                         if ( isset( $seen_attribute_names[ $qualified_attribute_name ] ) ) {
                                 continue;
@@ -1437 +1442 @@
                         if (
                                 $previous_attribute_was_true &&
-                                isset( $qualified_attribute_name[0] ) &&
-                                '=' === $qualified_attribute_name[0]
+                                isset( $serialized_attribute_name[0] ) &&
+                                '=' === $serialized_attribute_name[0]
                         ) {
                                 $html .= '=""';
                         }
 
-                        $html .= " {$qualified_attribute_name}";
+                        $html .= " {$serialized_attribute_name}";
                         $value = $this->get_attribute( $attribute_name );
 

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -3071 +3071 @@
          * Returns the adjusted attribute name for a given attribute, taking into
          * account the current parsing context, whether HTML, SVG, or MathML.
+         *
+         * In SVG and MathML contexts, adjusted foreign attributes with a namespace
+         * prefix use a space between the prefix and local name. For example,
+         * `xlink:href` is returned as `xlink href`, while the unprefixed `xmlns`
+         * attribute is returned as `xmlns`. Non-adjusted attributes with a colon in
+         * their name, such as `foo:bar`, are returned unchanged.
          *
          * @since 6.7.0

trunk/tests/phpunit/tests/html-api/wpHtmlProcessor-serialize.php

@@ -106 +106 @@
                         '<div one="1"></div>',
                         'Should have removed all but the first copy of an attribute when duplicates exist.'
+                );
+        }
+
+        /**
+         * Ensures that adjusted foreign attributes are serialized with their namespace prefix.
+         *
+         * @ticket 65372
+         */
+        public function test_serializes_adjusted_foreign_attributes_with_namespace_prefix(): void {
+                $svg = '<svg><a xlink:actuate="onLoad" xlink:arcrole="arc" xlink:href="#target" xlink:role="role" xlink:show="new" xlink:title="title" xlink:type="simple" xml:lang="en" xml:space="preserve" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"></a></svg>';
+
+                $this->assertSame(
+                        $svg,
+                        WP_HTML_Processor::normalize( $svg ),
+                        'Should have preserved all adjusted foreign attributes when normalizing.'
+                );
+
+                $processor = WP_HTML_Processor::create_fragment( $svg );
+                $this->assertTrue( $processor->next_token() );
+                $this->assertSame( '<svg>', $processor->serialize_token(), 'Should serialize the opening SVG tag.' );
+                $this->assertTrue( $processor->next_token() );
+                $this->assertSame(
+                        '<a xlink:actuate="onLoad" xlink:arcrole="arc" xlink:href="#target" xlink:role="role" xlink:show="new" xlink:title="title" xlink:type="simple" xml:lang="en" xml:space="preserve" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">',
+                        $processor->serialize_token(),
+                        'Should have serialized all adjusted foreign attributes with their namespace prefixes.'
+                );
+        }
+
+        /**
+         * Ensures that non-adjusted foreign attributes retain their colon.
+         *
+         * @ticket 65372
+         *
+         * @dataProvider data_non_adjusted_foreign_attributes_with_colon
+         *
+         * @param string $svg            SVG markup to normalize.
+         * @param string $serialized_tag Expected serialized token.
+         */
+        public function test_serializes_non_adjusted_foreign_attributes_with_colon( string $svg, string $serialized_tag ): void {
+                $this->assertSame(
+                        $svg,
+                        WP_HTML_Processor::normalize( $svg ),
+                        'Should have preserved non-adjusted colon attributes when normalizing.'
+                );
+
+                $processor = WP_HTML_Processor::create_fragment( $svg );
+                $this->assertTrue( $processor->next_token() );
+                $this->assertSame( '<svg>', $processor->serialize_token(), 'Should serialize the opening SVG tag.' );
+                $this->assertTrue( $processor->next_token() );
+                $this->assertSame(
+                        $serialized_tag,
+                        $processor->serialize_token(),
+                        'Should have preserved non-adjusted colon attributes when serializing the token.'
+                );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<string, array{0: string, 1: string}>
+         */
+        public static function data_non_adjusted_foreign_attributes_with_colon(): array {
+                return array(
+                        'xlink control' => array(
+                                '<svg><a xlink:author="author" xlink:href="#target"></a></svg>',
+                                '<a xlink:author="author" xlink:href="#target">',
+                        ),
+                        'xml control'   => array(
+                                '<svg><a xml:id="id" xml:lang="en"></a></svg>',
+                                '<a xml:id="id" xml:lang="en">',
+                        ),
+                        'xmlns control' => array(
+                                '<svg><a xmlns:foo="urn:foo" xmlns:xlink="http://www.w3.org/1999/xlink"></a></svg>',
+                                '<a xmlns:foo="urn:foo" xmlns:xlink="http://www.w3.org/1999/xlink">',
+                        ),
+                        'source order'  => array(
+                                '<svg><a foo:bar="baz" xlink:href="#target"></a></svg>',
+                                '<a foo:bar="baz" xlink:href="#target">',
+                        ),
+                );
+        }
+
+        /**
+         * Ensures that duplicate foreign attributes are removed upon serialization.
+         *
+         * @ticket 65372
+         *
+         * @dataProvider data_duplicate_foreign_attributes
+         *
+         * @param string $input    HTML containing duplicate foreign attributes.
+         * @param string $expected Expected normalized HTML.
+         */
+        public function test_duplicate_foreign_attributes_are_removed( string $input, string $expected ): void {
+                $this->assertSame(
+                        $expected,
+                        WP_HTML_Processor::normalize( $input ),
+                        'Should have removed all but the first copy of a foreign attribute when duplicates exist.'
+                );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<string, array{0: string, 1: string}>
+         */
+        public static function data_duplicate_foreign_attributes(): array {
+                return array(
+                        'adjusted xlink duplicate'       => array(
+                                '<svg><a xlink:href="#first" XLINK:HREF="#second"></a></svg>',
+                                '<svg><a xlink:href="#first"></a></svg>',
+                        ),
+                        'adjusted xml duplicate'         => array(
+                                '<svg><a xml:lang="en" XML:LANG="fr"></a></svg>',
+                                '<svg><a xml:lang="en"></a></svg>',
+                        ),
+                        'non-adjusted colon duplicate'   => array(
+                                '<svg><a foo:bar="one" FOO:BAR="two"></a></svg>',
+                                '<svg><a foo:bar="one"></a></svg>',
+                        ),
+                        'adjusted and non-adjusted pair' => array(
+                                '<svg><a xlink:href="#target" xlink:author="author"></a></svg>',
+                                '<svg><a xlink:href="#target" xlink:author="author"></a></svg>',
+                        ),
                 );
         }