Changeset 64386 for trunk/src/wp-settings.php

Timestamp:

10/16/2026 05:08:08 AM (2 days ago)

Author:

luisherranz

Message:

Interactivity API: Add server-side processing for the data-wp-html directive.

Adds server-side processing for the data-wp-html directive, whose client implementation was added in Gutenberg, so that trusted HTML produced in PHP is present in the server-rendered page.

The new wp_interactivity_as_dangerous_html() function returns a WP_Interactivity_Dangerous_HTML token that marks an HTML string as trusted. Only these tokens render. The HTML is neither sanitized nor processed for directives, and it is never included in the data printed for the client, where a token is encoded as {}. An unserialized token holds no HTML and does not render.

When the directive cannot render, the element keeps its existing content and a _doing_it_wrong() notice is raised. That happens when the value is not a token, when the element cannot hold content, or when the element also uses data-wp-text or data-wp-each on a template.

Also adds WP_Interactivity_API_Directives_Processor::set_raw_content_between_balanced_tags(), which replaces the content between balanced tags without escaping it.

Props darerodz.
Fixes #66246.

File:

• trunk/src/wp-settings.php (modified) (1 diff)

trunk/src/wp-settings.php

@@ -467 +467 @@
 require ABSPATH . WPINC . '/interactivity-api/class-wp-interactivity-api.php';
 require ABSPATH . WPINC . '/interactivity-api/class-wp-interactivity-api-directives-processor.php';
+require ABSPATH . WPINC . '/interactivity-api/class-wp-interactivity-dangerous-html.php';
 require ABSPATH . WPINC . '/interactivity-api/interactivity-api.php';
 require ABSPATH . WPINC . '/class-wp-plugin-dependencies.php';