Changeset 63913

Timestamp:

09/24/2026 05:53:51 AM (4 days ago)

Author:

jonsurrell

Message:

Block Processor: Ensure block delimiters align with single HTML comments.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13680

Props jonsurrell, dmsnell.
See #66138.

Location:

trunk

Files:

• src/wp-includes/class-wp-block-processor.php (modified) (7 diffs)
• tests/phpunit/tests/block-processor/wpBlockProcessor.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-block-processor.php

@@ -980 +980 @@
                          * even though it allows for matching invalid JSON content.
                          *
+                         * The delimiter must also be a single complete HTML comment.
+                         *
                          * <!-- /wp:core/paragraph {"dropCap":true} /-⃨-⃨>⃨
                          */
-                        $comment_closing_at = strpos( $text, '-->', $json_at );
-                        if ( false === $comment_closing_at ) {
+                        $after_comment_end = $this->find_html_comment_end( $comment_opening_at, $end );
+
+                        /*
+                         * The reported end of the comment could be after the end of the document if
+                         * no actual end was found, so differentiate a comment ending at the end of
+                         * the document from documents with missing comment ends.
+                         */
+                        if ( $after_comment_end >= $end && ! str_ends_with( $text, '-->' ) && ! str_ends_with( $text, '--!>' ) ) {
                                 goto incomplete;
                         }
+
+                        /*
+                         * Only normative comment closers are recognized block delimiters,
+                         * so skip past any HTML comments ending in `--!>`.
+                         */
+                        if ( '!' === $text[ $after_comment_end - 2 ] ) {
+                                $at = $after_comment_end;
+                                continue;
+                        }
+
+                        $comment_closing_at = $after_comment_end - 3;
 
                         // <!-- /wp:core/paragraph {"dropCap":true} /⃨-->
@@ -1008 +1027 @@
                                 }
 
-                                $at = $this->find_html_comment_end( $comment_opening_at, $end );
+                                $at = $after_comment_end;
                                 continue;
                         }
@@ -1016 +1035 @@
                          *
                          * @todo It’s likely faster to scan forward instead of in reverse.
+                         * @todo Skip ahead with `strcspn()` and decide only on syntax characters.
                          *
                          * <!-- /wp:core/paragraph {"dropCap":true}⃨ ⃨/-->
@@ -1037 +1057 @@
 
                                         default:
-                                                ++$at;
+                                                $at = $after_comment_end;
                                                 continue 3;
                                 }
@@ -1047 +1067 @@
                          */
                         if ( 0 === $json_length || 0 === $after_json_whitespace_length ) {
-                                $at = $this->find_html_comment_end( $comment_opening_at, $end );
+                                $at = $after_comment_end;
                                 continue;
                         }
@@ -1058 +1078 @@
                 // The end of the document was reached without a match.
                 if ( self::MATCHED !== $this->state ) {
+                        // Stop at top-level free-form HTML at the end of the document.
+                        if ( $after_prev_delimiter < $end ) {
+                                $this->state                    = self::HTML_SPAN;
+                                $this->after_previous_delimiter = $after_prev_delimiter;
+                                $this->matched_delimiter_at     = $end;
+                                $this->matched_delimiter_length = 0;
+                                $this->open_blocks_at[]         = $after_prev_delimiter;
+                                $this->open_blocks_length[]     = 0;
+                                $this->was_void                 = true;
+
+                                return true;
+                        }
+
                         $this->state = self::COMPLETE;
                         return false;
@@ -1337 +1370 @@
                         '>' === $text[ $comment_starting_at + 2 + $span_of_dashes ]
                 ) {
-                        return $comment_starting_at + $span_of_dashes + 1;
+                        return $comment_starting_at + 2 + $span_of_dashes + 1;
                 }
 

trunk/tests/phpunit/tests/block-processor/wpBlockProcessor.php

@@ -311 +311 @@
 
         /**
+         * Verifies that HTML comments which end a document but which are not block
+         * delimiters are incorporated into the final HTML span.
+         *
+         * @ticket 66138
+         *
+         * @dataProvider data_terminal_non_delimiter_comments
+         *
+         * @param string $html Input ending in a non-delimiter HTML comment.
+         */
+        public function test_preserves_terminal_non_delimiter_comments_as_html( string $html ): void {
+                $processor = new WP_Block_Processor( $html );
+
+                $this->assertTrue(
+                        $processor->next_token(),
+                        'Should have found a single HTML span but found nothing: check test setup.'
+                );
+
+                $this->assertTrue(
+                        $processor->is_html(),
+                        'Should have matched an HTML span.'
+                );
+
+                $this->assertSame(
+                        $html,
+                        $processor->get_html_content(),
+                        'Should have preserved the complete terminal HTML span.'
+                );
+
+                $this->assertFalse(
+                        $processor->next_token(),
+                        'Should have only found one token, an HTML comment, but found more: check test setup.'
+                );
+
+                $this->assertNull(
+                        $processor->get_last_error(),
+                        'Should have finished without error.'
+                );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<string, array{0: string}>
+         */
+        public static function data_terminal_non_delimiter_comments(): array {
+                return array(
+                        'Ordinary comment'           => array( 'content<!-- x -->' ),
+                        'Abrupt empty comment'       => array( 'content<!-->' ),
+                        'Rejected JSON attributes'   => array( 'content<!-- wp:a {x -->' ),
+                        'Exclamation comment ending' => array( 'content<!-- wp:a --!>' ),
+                );
+        }
+
+        /**
          * Verifies that incomplete HTML comments which could not produce delimiters
          * are not considered incomplete input by the processor.
@@ -536 +590 @@
                         $processor->next_delimiter(),
                         "Should have failed to find block delimiter but found '{$processor->get_block_type()}' instead."
+                );
+        }
+
+        /**
+         * Verifies that a delimiter does not span the end of the comment it started in.
+         *
+         * An HTML comment ends at its first `-->` or `--!>`. The scan looked only for
+         * `-->`, so a comment ended by `--!>` was stepped over and a later `-->` was
+         * taken as the end of the delimiter, producing a delimiter which spanned two
+         * comments.
+         *
+         * @ticket 66138
+         *
+         * @dataProvider data_delimiters_and_comment_endings
+         *
+         * @param string   $html        Document to scan.
+         * @param string[] $block_types Printable block type of every delimiter in the document, in order.
+         */
+        public function test_delimiter_does_not_span_a_comment_ending( string $html, array $block_types ): void {
+                $processor = new WP_Block_Processor( $html );
+
+                $found = array();
+                while ( $processor->next_delimiter() ) {
+                        $found[] = $processor->get_printable_block_type();
+                }
+
+                $this->assertSame(
+                        $block_types,
+                        $found,
+                        'Should have found only the delimiters which are in the document.'
+                );
+        }
+
+        /**
+         * Verifies that a comment ended by `--!>` at the end of the document is not
+         * reported as incomplete input: the comment is closed, so no delimiter could
+         * be completed by further input.
+         *
+         * @ticket 66138
+         */
+        public function test_exclamation_ending_at_end_of_document_is_not_incomplete_input(): void {
+                $processor = new WP_Block_Processor( '<!-- wp:a {"k":"x --!>' );
+
+                $this->assertFalse(
+                        $processor->next_delimiter(),
+                        "Should have found no delimiter but found a '{$processor->get_block_type()}' instead."
+                );
+
+                $this->assertNull(
+                        $processor->get_last_error(),
+                        'Should have completed without reporting an error.'
+                );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<string, array{0: string, 1: string[]}>
+         */
+        public static function data_delimiters_and_comment_endings(): array {
+                return array(
+                        // The comment ended at `--!>`, so the later `-->` is not the delimiter's end.
+                        'Spans an exclamation ending'      => array( '<!-- wp:a {"k":"x --!><!-- y"} -->', array() ),
+                        'Spans two exclamation endings'    => array( '<!-- wp:a {"k":"x --!><!-- y --!><!-- z"} -->', array() ),
+                        'Exclamation ending at the end'    => array( '<!-- wp:a {"k":"x --!>', array() ),
+                        'Repeated exclamation endings'     => array( str_repeat( '<!-- wp:a {"k":" --!>', 100 ) . '"} -->', array() ),
+
+                        // Rejected for other reasons, asserted so the comment ending is not what rescues them.
+                        'Exclamation ending, no JSON'      => array( '<!-- wp:a --!><!-- "} -->', array() ),
+                        'Opening inside a dashed comment'  => array( '<!---<!-- wp:a {"k":1} -->', array() ),
+
+                        // Delimiters which stay inside one comment are unaffected.
+                        'Plain delimiter'                  => array( '<!-- wp:a -->', array( 'core/a' ) ),
+                        'Delimiter with attributes'        => array( '<!-- wp:a {"k":1} -->', array( 'core/a' ) ),
+                        'Void delimiter'                   => array( '<!-- wp:a {"k":1} /-->', array( 'core/a' ) ),
+                        'Hyphens inside the attributes'    => array( '<!-- wp:a {"k":"x--y"} -->', array( 'core/a' ) ),
+                        'Dash run inside the attributes'   => array( '<!-- wp:a {"k":"x-----y"} -->', array( 'core/a' ) ),
+                        'Dash run then bang'               => array( '<!-- wp:a {"k":"x---!y"} -->', array( 'core/a' ) ),
+                        'Bang then dashes'                 => array( '<!-- wp:a {"k":"x--!-y"} -->', array( 'core/a' ) ),
+                        'Dashes before the closer'         => array( '<!-- wp:a {"k":"x--"} -->', array( 'core/a' ) ),
+                        'Dash run before a space closer'   => array( '<!-- wp:a {"k":"x"} --- -->', array() ),
+                        'Delimiter after a closed comment' => array( '<!-- x --!><!-- wp:a {"k":1} -->', array( 'core/a' ) ),
+                );
+        }
+
+        /**
+         * Verifies that a comment whose JSON attributes are rejected is skipped whole.
+         *
+         * A block delimiter is a single HTML comment. When the content after the JSON
+         * attributes rules out a delimiter, the scan resumes after that comment, not one
+         * byte later, so a `<!--` inside the comment's text is not treated as the start
+         * of another delimiter.
+         *
+         * @ticket 66138
+         *
+         * @dataProvider data_comments_with_rejected_json_attributes
+         *
+         * @param string   $html        Document to scan.
+         * @param string[] $block_types Printable block type of every delimiter in the document, in order.
+         */
+        public function test_skips_the_whole_comment_when_the_json_attributes_are_rejected( string $html, array $block_types ): void {
+                $processor = new WP_Block_Processor( $html );
+
+                $found = array();
+                while ( $processor->next_delimiter() ) {
+                        $found[] = $processor->get_printable_block_type();
+                }
+
+                $this->assertSame(
+                        $block_types,
+                        $found,
+                        'Should have found only the delimiters which are in the document.'
+                );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array<string, array{0: string, 1: string[]}>
+         */
+        public static function data_comments_with_rejected_json_attributes(): array {
+                return array(
+                        // A `<!--` inside the comment's text does not start a delimiter.
+                        'Opening inside the comment'      => array( '<!-- wp:a {x <!-- wp:b -->', array() ),
+                        'Void opening inside the comment' => array( '<!-- wp:a {x <!-- wp:b /-->', array() ),
+                        'Closer inside the comment'       => array( '<!-- wp:a {x <!-- /wp:b -->', array() ),
+
+                        // A delimiter in a later comment is still found.
+                        'Delimiter in the next comment'   => array( '<!-- wp:a {x --><!-- wp:b -->', array( 'core/b' ) ),
+                        'Content after the JSON'          => array( '<!-- wp:a {"k":1} x --><!-- wp:b -->', array( 'core/b' ) ),
+                        'Valid delimiter first'           => array( '<!-- wp:a {"k":1} --><!-- wp:b {y -->', array( 'core/a' ) ),
                 );
         }