Opened 5 weeks ago
Closed 2 days ago
#65824 closed enhancement (fixed)
HTML API: Allow more set_modifiable_text contents where possible.
| Reported by: | jonsurrell | Owned by: | jonsurrell |
|---|---|---|---|
| Priority: | low | Milestone: | 7.2 |
| Component: | HTML API | Version: | |
| Severity: | trivial | Keywords: | good-first-bug has-patch has-unit-tests commit |
| Cc: | Focuses: |
Description
There are cases where ::set_modifiable_text() rejects contents that are safe.
Some cases reject based on false !== stripos( $plaintext_content, "</{$tag_name}" ) in the text to be set:
- https://github.com/WordPress/wordpress-develop/blob/b21fdb73bfd67730d90ec2895f9372e42e26655c/src/wp-includes/html-api/class-wp-html-tag-processor.php#L4083-L4097
- https://github.com/WordPress/wordpress-develop/blob/b21fdb73bfd67730d90ec2895f9372e42e26655c/src/wp-includes/html-api/class-wp-html-tag-processor.php#L4117
Those cases could all check for a case-insensitive match like "</{$tag_name}" immediately followed by one of the characters in " \t\f\r\n/>".
Change History (4)
This ticket was mentioned in PR #12914 on WordPress/wordpress-develop by @khokansardar.
5 weeks ago
#1
- Keywords has-patch has-unit-tests added
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
WP_HTML_Tag_Processor::set_modifiable_text()rejects any content containing</followed by the element's own tag name, even where that sequence cannot close the element. This relaxes the check to match the tokenizer.What the problem was:
stripos()substring test rejected safe text such as</xmp-tag>in an XMP element, or</scriptx>in a SCRIPT element with an unrecognized content type.What the fix does:
,\t,\f,\r,\n,/, or>before rejecting the update, at both cited sites.Approach and why:
\fis retained even though WP's tokenizer does not currently treat it as a terminator, because browsers do.Trac ticket: https://core.trac.wordpress.org/ticket/65824
## Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5
Used for: Ticket analysis, tests and PR generates. All changes were reviewed and validated by me.