Changeset 62492 for trunk/src/wp-includes/html-api/class-wp-html-processor.php

Timestamp:

06/11/2026 10:17:13 PM (3 months ago)

Author:

dmsnell

Message:

HTML API: preserve adjusted foreign attributes on serialization.

Discovered during fuzz-testing of the HTML API. Adjusted foreign attributes, such as xlink:href, were being normalized with a space instead of a colon through ::serialize_token(). This led to the creation of two attributes on output instead of the proper singular attribute.

This patch corrects the issue by ensuring that the attribute namespace and name are separated by a colon when serializing.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12140
Discussed in: https://core.trac.wordpress.org/ticket/65372

Props jonsurrell.
See #65372.

File:

• trunk/src/wp-includes/html-api/class-wp-html-processor.php (modified) (2 diffs)

trunk/src/wp-includes/html-api/class-wp-html-processor.php

@@ -1429 +1429 @@
                         $qualified_attribute_name = str_replace( "\x00", "\u{FFFD}", $qualified_attribute_name );
                         $qualified_attribute_name = wp_scrub_utf8( $qualified_attribute_name );
+                        /**
+                         * Spaces only appear via the foreign attribute adjustment table.
+                         * @see WP_HTML_Tag_Processor::get_qualified_attribute_name()
+                         */
+                        $serialized_attribute_name = str_replace( ' ', ':', $qualified_attribute_name );
                         if ( isset( $seen_attribute_names[ $qualified_attribute_name ] ) ) {
                                 continue;
@@ -1437 +1442 @@
                         if (
                                 $previous_attribute_was_true &&
-                                isset( $qualified_attribute_name[0] ) &&
-                                '=' === $qualified_attribute_name[0]
+                                isset( $serialized_attribute_name[0] ) &&
+                                '=' === $serialized_attribute_name[0]
                         ) {
                                 $html .= '=""';
                         }
 
-                        $html .= " {$qualified_attribute_name}";
+                        $html .= " {$serialized_attribute_name}";
                         $value = $this->get_attribute( $attribute_name );