Changeset 63513

Timestamp:

09/07/2026 08:45:50 AM (5 weeks ago)

Author:

jonsurrell

Message:

HTML API: Allow raw text which cannot close its own element.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/12914

Props khokansardar, jonsurrell, shailu25.
Fixes #65824.

Location:

trunk

Files:

• src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (2 diffs)
• tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php (modified) (2 diffs)

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -4093 +4093 @@
                                  * HTML structure is rejected here. It’s the responsibility of calling code to
                                  * perform whatever semantic escaping is necessary to avoid problematic strings.
+                                 *
+                                 * Both the start tag `<script` and the end tag `</script` are rejected. It’s
+                                 * easy to assume that only an end tag can alter the HTML structure, but a
+                                 * start tag which follows `<!--` moves the tokenizer into the double-escaped
+                                 * states, where a later `</script>` no longer closes the element.
+                                 *
+                                 * In both cases the tag name ends only at one of the characters matched
+                                 * below, so text such as `</scriptx>` cannot change that structure and is
+                                 * safe to set.
+                                 *
+                                 * @link https://html.spec.whatwg.org/#script-data-end-tag-name-state
+                                 * @link https://html.spec.whatwg.org/#script-data-double-escape-start-state
                                  */
-                                if (
-                                        false !== stripos( $plaintext_content, '<script' ) ||
-                                        false !== stripos( $plaintext_content, '</script' )
-                                ) {
+                                if ( 1 === preg_match( '~</?script[ \t\f\r\n/>]~i', $plaintext_content ) ) {
                                         _doing_it_wrong(
                                                 __METHOD__,
@@ -4117 +4126 @@
                         case 'XMP':
                                 $tag_name = $this->get_tag();
-                                if ( false !== stripos( $plaintext_content, "</{$tag_name}" ) ) {
+
+                                /*
+                                 * A tag name ends only at one of the characters matched below, so text
+                                 * such as `</xmp-tag>` cannot close the element and is safe to set.
+                                 *
+                                 * @link https://html.spec.whatwg.org/#rawtext-end-tag-name-state
+                                 */
+                                if ( 1 === preg_match( '~</' . preg_quote( $tag_name, '~' ) . '[ \t\f\r\n/>]~i', $plaintext_content ) ) {
                                         _doing_it_wrong(
                                                 __METHOD__,

trunk/tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php

@@ -661 +661 @@
          * @ticket 61617
          * @ticket 62797
+         * @ticket 65824
          *
          * @dataProvider data_unallowed_modifiable_text_updates
@@ -715 +716 @@
                         'Non-JS SCRIPT with <script attributes>'  => array( '<script language="text">Replace me</script>', '<!-- <script sneaky>after' ),
                         'Non-JS SCRIPT with </script attributes>' => array( '<script language="text">Replace me</script>', 'before</script sneaky>after' ),
+                        'XMP with </xmp/>'                        => array( '<xmp>Replace me</xmp>', 'Also closed by </xmp/>' ),
+                        'XMP with </xmp\f>'                       => array( '<xmp>Replace me</xmp>', "Also closed by </xmp\f>" ),
+                        'Non-JS SCRIPT with </script\r>'          => array( '<script language="text">Replace me</script>', "before</script\r>after" ),
+                );
+        }
+
+        /**
+         * Ensures that raw text which resembles a closing tag, but cannot close its
+         * element, is allowed as modifiable text.
+         *
+         * @ticket 65824
+         *
+         * @dataProvider data_raw_text_resembling_a_closing_tag
+         *
+         * @param string $html     HTML whose first tag holds the raw text to replace.
+         * @param string $update   Text resembling, but not forming, that element's closing tag.
+         * @param string $expected Expected document after the update.
+         */
+        public function test_allows_raw_text_which_cannot_close_its_element( string $html, string $update, string $expected ): void {
+                $processor = new WP_HTML_Tag_Processor( $html );
+                $processor->next_tag();
+
+                $this->assertTrue(
+                        $processor->set_modifiable_text( $update ),
+                        'Should have allowed text which cannot close the element.'
+                );
+
+                $this->assertSame(
+                        $expected,
+                        $processor->get_updated_html(),
+                        'Should have updated the document as expected.'
+                );
+
+                $reparsed = new WP_HTML_Tag_Processor( $expected );
+                $reparsed->next_tag();
+
+                $this->assertSame(
+                        $update,
+                        $reparsed->get_modifiable_text(),
+                        'Should have preserved the text when re-parsing the updated document.'
+                );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array[]
+         */
+        public static function data_raw_text_resembling_a_closing_tag(): array {
+                return array(
+                        'IFRAME with </iframely>'          => array( '<iframe>Replace me</iframe>', 'Just a </iframely>', '<iframe>Just a </iframely></iframe>' ),
+                        'NOEMBED with </NOEMBEDDED>'       => array( '<noembed>Replace me</noembed>', 'Just a </NOEMBEDDED>', '<noembed>Just a </NOEMBEDDED></noembed>' ),
+                        'NOFRAMES with </noframes->'       => array( '<noframes>Replace me</noframes>', 'before</noframes->after', '<noframes>before</noframes->after</noframes>' ),
+                        'XMP with </xmp-tag>'              => array( '<xmp>Replace me</xmp>', 'Just a </xmp-tag>', '<xmp>Just a </xmp-tag></xmp>' ),
+                        'XMP ending in </xmp'              => array( '<xmp>Replace me</xmp>', 'Trailing </xmp', '<xmp>Trailing </xmp</xmp>' ),
+                        'Non-JS SCRIPT with <scriptish>'   => array( '<script type="text/plain">Replace me</script>', '<!-- <scriptish> -->', '<script type="text/plain"><!-- <scriptish> --></script>' ),
+                        'Non-JS SCRIPT with </scriptx>'    => array( '<script type="text/plain">Replace me</script>', 'Just a </scriptx>', '<script type="text/plain">Just a </scriptx></script>' ),
+                        'Non-JS SCRIPT ending in <script'  => array( '<script type="text/plain">Replace me</script>', '<!-- <script', '<script type="text/plain"><!-- <script</script>' ),
+                        'Non-JS SCRIPT ending in </script' => array( '<script type="text/plain">Replace me</script>', 'Trailing </script', '<script type="text/plain">Trailing </script</script>' ),
                 );
         }