Changeset 62492 for trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

Timestamp:

06/11/2026 10:17:13 PM (3 months ago)

Author:

dmsnell

Message:

HTML API: preserve adjusted foreign attributes on serialization.

Discovered during fuzz-testing of the HTML API. Adjusted foreign attributes, such as xlink:href, were being normalized with a space instead of a colon through ::serialize_token(). This led to the creation of two attributes on output instead of the proper singular attribute.

This patch corrects the issue by ensuring that the attribute namespace and name are separated by a colon when serializing.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12140
Discussed in: https://core.trac.wordpress.org/ticket/65372

Props jonsurrell.
See #65372.

File:

• trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -3071 +3071 @@
          * Returns the adjusted attribute name for a given attribute, taking into
          * account the current parsing context, whether HTML, SVG, or MathML.
+         *
+         * In SVG and MathML contexts, adjusted foreign attributes with a namespace
+         * prefix use a space between the prefix and local name. For example,
+         * `xlink:href` is returned as `xlink href`, while the unprefixed `xmlns`
+         * attribute is returned as `xmlns`. Non-adjusted attributes with a colon in
+         * their name, such as `foo:bar`, are returned unchanged.
          *
          * @since 6.7.0