Changeset 63380 for trunk/src/wp-includes/functions.php

Timestamp:

08/28/2026 12:04:49 AM (6 weeks ago)

Author:

dmsnell

Message:

HTML API: Refactor wp_get_admin_notice().

Refactors wp_get_admin_notice() to rely on the HTML API for HTML generation. This provides more reliable parsing and hardening for and against the provided arguments, but introduces behavioral changes that should only affect already-broken cases.

Namely, the function previously generated its output and then mandated that calling code run it through wp_kses(). This meant that certain kinds of corruption were possible which would break boundaries within the generated HTML and result in mangled output through wp_kses(). Now, the function preserves all boundaries when generating the output, meaning that wp_kses() will receive already-normalized content.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13273
Discussed in: https://core.trac.wordpress.org/ticket/65984

Props dmsnell, joedolson, johnbillion, jorbin.
See #65984.

File:

• trunk/src/wp-includes/functions.php (modified) (4 diffs)

trunk/src/wp-includes/functions.php

@@ -9238 +9238 @@
          * @param string $message The message for the admin notice.
          */
-        $args       = apply_filters( 'wp_admin_notice_args', $args, $message );
-        $id         = '';
-        $classes    = 'notice';
-        $attributes = '';
+        $args = apply_filters( 'wp_admin_notice_args', $args, $message );
+
+        $wrap_with_p  = false !== $args['paragraph_wrap'];
+        $wrap_opener  = $wrap_with_p ? '<p>' : '';
+        $wrap_closer  = $wrap_with_p ? '</p>' : '';
+        $html_builder = new WP_HTML_Tag_Processor( "<div class=\"notice\">{$wrap_opener}" );
+        $html_builder->next_token();
 
         if ( is_string( $args['id'] ) ) {
@@ -9247 +9250 @@
 
                 if ( '' !== $trimmed_id ) {
-                        $id = 'id="' . $trimmed_id . '" ';
+                        $html_builder->set_attribute( 'id', $trimmed_id );
                 }
         }
@@ -9254 +9257 @@
                 $type = trim( $args['type'] );
 
-                if ( str_contains( $type, ' ' ) ) {
+                if ( strlen( $type ) !== strcspn( $type, " \f\t\r\n" ) ) {
                         _doing_it_wrong(
                                 __FUNCTION__,
@@ -9267 +9270 @@
 
                 if ( '' !== $type ) {
-                        $classes .= ' notice-' . $type;
+                        $html_builder->add_class( "notice-{$type}" );
                 }
         }
 
         if ( true === $args['dismissible'] ) {
-                $classes .= ' is-dismissible';
+                $html_builder->add_class( 'is-dismissible' );
         }
 
         if ( is_array( $args['additional_classes'] ) && ! empty( $args['additional_classes'] ) ) {
-                $classes .= ' ' . implode( ' ', $args['additional_classes'] );
+                foreach ( $args['additional_classes'] as $class_name ) {
+                        $html_builder->add_class( $class_name );
+                }
         }
 
         if ( is_array( $args['attributes'] ) && ! empty( $args['attributes'] ) ) {
-                $attributes = '';
-                foreach ( $args['attributes'] as $attr => $val ) {
-                        if ( is_bool( $val ) ) {
-                                $attributes .= $val ? ' ' . $attr : '';
-                        } elseif ( is_int( $attr ) ) {
-                                $attributes .= ' ' . esc_attr( trim( $val ) );
-                        } elseif ( $val ) {
-                                $attributes .= ' ' . $attr . '="' . esc_attr( trim( $val ) ) . '"';
+                foreach ( $args['attributes'] as $name => $value ) {
+                        if ( is_int( $name ) ) {
+                                /*
+                                 * Boolean attributes may have been appended as numeric list items,
+                                 * for example, with `$args['attributes'][] = 'disabled'`. They should
+                                 * be recorded with the value serving as their name.
+                                 */
+                                $html_builder->set_attribute( $value, true );
+                        } elseif ( true === $value ) {
+                                $html_builder->set_attribute( $name, true );
+                        } elseif ( false !== $value ) {
+                                $html_builder->set_attribute( $name, trim( (string) $value ) );
                         }
                 }
         }
 
-        if ( false !== $args['paragraph_wrap'] ) {
-                $message = "<p>$message</p>";
-        }
-
-        $markup = sprintf( '<div %1$sclass="%2$s"%3$s>%4$s</div>', $id, $classes, $attributes, $message );
+        $markup  = $html_builder->get_updated_html();
+        $markup .= $message;
+        $markup .= "{$wrap_closer}</div>";
 
         /**