Make WordPress Core

Opened 5 weeks ago

Closed 2 days ago

#65824 closed enhancement (fixed)

HTML API: Allow more set_modifiable_text contents where possible.

Reported by: jonsurrell Owned by: jonsurrell
Priority: low Milestone: 7.2
Component: HTML API Version:
Severity: trivial Keywords: good-first-bug has-patch has-unit-tests commit
Cc: Focuses:

Description

There are cases where ::set_modifiable_text() rejects contents that are safe.

Some cases reject based on false !== stripos( $plaintext_content, "</{$tag_name}" ) in the text to be set:

Those cases could all check for a case-insensitive match like "</{$tag_name}" immediately followed by one of the characters in " \t\f\r\n/>".

See this thread for details.

Change History (4)

This ticket was mentioned in PR #12914 on WordPress/wordpress-develop by @khokansardar.


5 weeks ago
#1

  • Keywords has-patch has-unit-tests added

WP_HTML_Tag_Processor::set_modifiable_text() rejects any content containing </ followed by the element's own tag name, even where that sequence cannot close the element. This relaxes the check to match the tokenizer.

What the problem was:

  • A plain stripos() substring test rejected safe text such as </xmp-tag> in an XMP element, or </scriptx> in a SCRIPT element with an unrecognized content type.

What the fix does:

  • Requires the tag name to be terminated by one of , \t, \f, \r, \n, /, or > before rejecting the update, at both cited sites.

Approach and why:

  • This is the check the tokenizer itself performs in the RAWTEXT / script-data end tag name states, so accepted text is exactly the text that round-trips. \f is retained even though WP's tokenizer does not currently treat it as a terminator, because browsers do.

Trac ticket: https://core.trac.wordpress.org/ticket/65824

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5
Used for: Ticket analysis, tests and PR generates. All changes were reviewed and validated by me.

#2 @jonsurrell
5 weeks ago

  • Milestone Future Release7.2
  • Owner set to jonsurrell
  • Status newaccepted

#3 @jonsurrell
4 weeks ago

  • Keywords commit added

The PR at 91e9ed72f3d58de601c2c42ad670d8bb050b6ecf seems ready. I'll refrain from committing until the current 7.1 release is settled.

#4 @jonsurrell
2 days ago

  • Resolutionfixed
  • Status acceptedclosed

In 63513:

HTML API: Allow raw text which cannot close its own element.

Developed in: https://github.com/WordPress/wordpress-develop/pull/12914

Props khokansardar, jonsurrell, shailu25.
Fixes #65824.

Note: See TracTickets for help on using tickets.