Changeset 63059

Timestamp:

08/06/2026 03:29:43 PM (6 weeks ago)

Author:

johnbillion

Message:

Emoji: Ensure that the emoji settings come from a script element.

Props westonruter, jonsurrell, peterwilsoncc, davidbinda, lucasbustamante.

Location:

trunk/src

Files:

• js/_enqueues/lib/emoji-loader.js (modified) (1 diff)
• wp-includes/class-wp-script-modules.php (modified) (1 diff)

trunk/src/js/_enqueues/lib/emoji-loader.js

@@ -17 +17 @@
  */
 
-const settings = /** @type {WPEmojiSettings} */ (
-        JSON.parse( document.getElementById( 'wp-emoji-settings' ).textContent )
-);
+const selector = 'script#wp-emoji-settings';
+const script = document.querySelector( selector );
+if ( ! ( script instanceof HTMLScriptElement ) ) {
+        throw new Error( `Element missing: ${ selector }`);
+}
+const settings = /** @type {WPEmojiSettings} */ ( JSON.parse( script.text ) );
 
 // For compatibility with other scripts that read from this global, in particular wp-includes/js/wp-emoji.js (source file: js/_enqueues/wp/emoji.js).

trunk/src/wp-includes/class-wp-script-modules.php

@@ -1059 +1059 @@
                          * tag with an ID of the form `wp-script-module-data-{$module_id}`.
                          *
-                         * The data can be read on the client with a pattern like this:
+                         * The data can be read on the client with a pattern like the following; you are encouraged
+                         * to use this pattern _verbatim_ to avoid common pitfalls or vulnerabilities:
                          *
                          * Example:
                          *
-                         *     const dataContainer = document.getElementById( 'wp-script-module-data-MyScriptModuleID' );
+                         *     const dataContainer = document.querySelector( 'script[id="wp-script-module-data-MyScriptModuleID"]' );
                          *     let data = {};
-                         *     if ( dataContainer ) {
+                         *     if ( dataContainer instanceof HTMLScriptElement ) {
                          *         try {
-                         *             data = JSON.parse( dataContainer.textContent );
+                         *             data = JSON.parse( dataContainer.text );
                          *         } catch {}
                          *     }