Changeset 63913 for trunk/src/wp-includes/class-wp-block-processor.php

Timestamp:

09/24/2026 05:53:51 AM (4 days ago)

Author:

jonsurrell

Message:

Block Processor: Ensure block delimiters align with single HTML comments.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13680

Props jonsurrell, dmsnell.
See #66138.

File:

• trunk/src/wp-includes/class-wp-block-processor.php (modified) (7 diffs)

trunk/src/wp-includes/class-wp-block-processor.php

@@ -980 +980 @@
                          * even though it allows for matching invalid JSON content.
                          *
+                         * The delimiter must also be a single complete HTML comment.
+                         *
                          * <!-- /wp:core/paragraph {"dropCap":true} /-⃨-⃨>⃨
                          */
-                        $comment_closing_at = strpos( $text, '-->', $json_at );
-                        if ( false === $comment_closing_at ) {
+                        $after_comment_end = $this->find_html_comment_end( $comment_opening_at, $end );
+
+                        /*
+                         * The reported end of the comment could be after the end of the document if
+                         * no actual end was found, so differentiate a comment ending at the end of
+                         * the document from documents with missing comment ends.
+                         */
+                        if ( $after_comment_end >= $end && ! str_ends_with( $text, '-->' ) && ! str_ends_with( $text, '--!>' ) ) {
                                 goto incomplete;
                         }
+
+                        /*
+                         * Only normative comment closers are recognized block delimiters,
+                         * so skip past any HTML comments ending in `--!>`.
+                         */
+                        if ( '!' === $text[ $after_comment_end - 2 ] ) {
+                                $at = $after_comment_end;
+                                continue;
+                        }
+
+                        $comment_closing_at = $after_comment_end - 3;
 
                         // <!-- /wp:core/paragraph {"dropCap":true} /⃨-->
@@ -1008 +1027 @@
                                 }
 
-                                $at = $this->find_html_comment_end( $comment_opening_at, $end );
+                                $at = $after_comment_end;
                                 continue;
                         }
@@ -1016 +1035 @@
                          *
                          * @todo It’s likely faster to scan forward instead of in reverse.
+                         * @todo Skip ahead with `strcspn()` and decide only on syntax characters.
                          *
                          * <!-- /wp:core/paragraph {"dropCap":true}⃨ ⃨/-->
@@ -1037 +1057 @@
 
                                         default:
-                                                ++$at;
+                                                $at = $after_comment_end;
                                                 continue 3;
                                 }
@@ -1047 +1067 @@
                          */
                         if ( 0 === $json_length || 0 === $after_json_whitespace_length ) {
-                                $at = $this->find_html_comment_end( $comment_opening_at, $end );
+                                $at = $after_comment_end;
                                 continue;
                         }
@@ -1058 +1078 @@
                 // The end of the document was reached without a match.
                 if ( self::MATCHED !== $this->state ) {
+                        // Stop at top-level free-form HTML at the end of the document.
+                        if ( $after_prev_delimiter < $end ) {
+                                $this->state                    = self::HTML_SPAN;
+                                $this->after_previous_delimiter = $after_prev_delimiter;
+                                $this->matched_delimiter_at     = $end;
+                                $this->matched_delimiter_length = 0;
+                                $this->open_blocks_at[]         = $after_prev_delimiter;
+                                $this->open_blocks_length[]     = 0;
+                                $this->was_void                 = true;
+
+                                return true;
+                        }
+
                         $this->state = self::COMPLETE;
                         return false;
@@ -1337 +1370 @@
                         '>' === $text[ $comment_starting_at + 2 + $span_of_dashes ]
                 ) {
-                        return $comment_starting_at + $span_of_dashes + 1;
+                        return $comment_starting_at + 2 + $span_of_dashes + 1;
                 }