Changeset 65371

Timestamp:

11/10/2026 05:22:33 AM (15 hours ago)

Author:

luisherranz

Message:

Interactivity API: Choose the data-wp-html placeholder marker in linear time.

Replace the repeated input-search loop with a UUID-based marker, generated
when the first data-wp-html host renders and reused by subsequent hosts
in the same processing call.

This removes input-dependent searching, keeps placeholder length fixed,
and avoids generating a UUID when no host renders.

Props jonsurrell.
Fixes #66498.

Location:

trunk

Files:

• src/wp-includes/interactivity-api/class-wp-interactivity-api.php (modified) (3 diffs)
• tests/phpunit/tests/interactivity-api/wpInteractivityAPI-wp-html.php (modified) (3 diffs)

trunk/src/wp-includes/interactivity-api/class-wp-interactivity-api.php

@@ -184 +184 @@
         /**
          * Marker that makes the placeholders of the current `process_directives()`
-         * call recognizable. It occurs nowhere in the HTML that call received, and
-         * it differs from the marker of any call that the current one runs inside.
+         * call recognizable, or an empty string until the first `data-wp-html` host
+         * of the call renders and draws it. It holds a random UUID, so no text
+         * written before the call can realistically hold it.
          *
          * @since 7.2.0
@@ -537 +538 @@
                  * The trusted HTML of `data-wp-html` hosts never takes part in the
                  * processing: each host receives a placeholder comment, and the comments
-                 * are replaced by their HTML once the result is known. The marker that
-                 * identifies them is chosen so that it occurs nowhere in the input, which
-                 * makes it impossible for the input to contain a placeholder. It is also
-                 * longer than the marker of any call this one runs inside, so their
-                 * placeholders never coincide.
+                 * are replaced by their HTML once the result is known. The call starts
+                 * without the marker that identifies them: the first host that renders
+                 * draws it, so a call without such a host does no marker work.
                  */
-                $marker = '' === $this->html_placeholder_marker ? 'wp-interactivity-dangerous-html' : $this->html_placeholder_marker . '_';
-                while ( str_contains( $html, $marker ) ) {
-                        $marker .= '_';
-                }
-                $this->html_placeholder_marker = $marker;
+                $this->html_placeholder_marker = '';
                 $this->html_placeholders       = array();
 
@@ -1699 +1694 @@
                  * The HTML is held back and a placeholder comment takes its place, so no
                  * later step of the call scans it. A comment is a single token for the
-                 * processors, and the marker in it occurs nowhere in the input.
+                 * processors. Its marker holds a random UUID, drawn once per call by the
+                 * first host that renders, so no text written before the call can
+                 * realistically contain a placeholder.
                  */
+                if ( '' === $this->html_placeholder_marker ) {
+                        $this->html_placeholder_marker = 'wp-interactivity-dangerous-html-' . wp_generate_uuid4();
+                }
                 $placeholder = '<!--' . $this->html_placeholder_marker . ':' . count( $this->html_placeholders ) . '-->';
                 if ( $p->skip_to_balanced_tag_closer( $placeholder ) ) {

trunk/tests/phpunit/tests/interactivity-api/wpInteractivityAPI-wp-html.php

@@ -1094 +1094 @@
 
         /**
-         * Tests that markup in the input that looks like a placeholder is not
-         * mistaken for one, however many marker variants it holds.
+         * Tests that markup in the input that looks like a placeholder, but holds a
+         * marker other than the call's own, is not mistaken for one. That includes
+         * the form of the call's own placeholders with a UUID other than the call's.
          *
          * @ticket 66246
@@ -1102 +1103 @@
          */
         public function test_substitution_cannot_be_forged() {
-                $lookalikes = '<!--wp-interactivity-dangerous-html:0--><!--wp-interactivity-dangerous-html_:0-->';
+                $lookalikes = '<!--wp-interactivity-dangerous-html:0--><!--wp-interactivity-dangerous-html_:0-->' .
+                        '<!--wp-interactivity-dangerous-html-3f2b8c1e-7d4a-4e9b-a5c6-0d1e2f3a4b5c:0-->';
                 $this->set_state( array( 'html' => $this->token() ) );
 
@@ -1111 +1113 @@
                 $this->assertSame(
                         '<div data-wp-interactive="test"><i>' . $lookalikes . '</i><p data-wp-html="state.html">' . self::MARKER_HTML . '</p></div>',
-                        $output
-                );
-        }
-
-        /**
-         * Tests that HTML that looks like the placeholder of another host is
-         * inserted as given, not replaced by that host's HTML.
-         *
-         * @ticket 66246
-         *
-         * @covers ::process_directives
-         */
-        public function test_inserted_html_is_not_searched_for_placeholders() {
-                $lookalike = '<!--wp-interactivity-dangerous-html:1-->';
-                $this->set_state(
-                        array(
-                                'first'  => wp_interactivity_as_dangerous_html( $lookalike ),
-                                'second' => wp_interactivity_as_dangerous_html( '<u>second</u>' ),
-                        )
-                );
-
-                $output = wp_interactivity_process_directives(
-                        '<div data-wp-interactive="test"><p data-wp-html="state.first">One</p><p data-wp-html="state.second">Two</p></div>'
-                );
-
-                $this->assertSame(
-                        '<div data-wp-interactive="test"><p data-wp-html="state.first">' . $lookalike . '</p><p data-wp-html="state.second"><u>second</u></p></div>',
                         $output
                 );