HTML API: Allow raw text which cannot close its own element - #12914
HTML API: Allow raw text which cannot close its own element#12914itzmekhokan wants to merge 4 commits into
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
e2fc957 to
0da1cf3
Compare
| * A tag name ends only at one of the characters matched below, so text | ||
| * such as `</xmp-tag>` cannot close the element and is safe to set. | ||
| * | ||
| * @see https://html.spec.whatwg.org/#rawtext-end-tag-name-state |
There was a problem hiding this comment.
| * @see https://html.spec.whatwg.org/#rawtext-end-tag-name-state | |
| * @link https://html.spec.whatwg.org/#rawtext-end-tag-name-state |
There was a problem hiding this comment.
Thanks, applied in a58274f. I also switched the two @see spec URLs in the SCRIPT case above to @link so the patch is consistent.
| * such as `</scriptx>` cannot change that structure and is safe to set. | ||
| * | ||
| * @see https://html.spec.whatwg.org/#script-data-end-tag-name-state | ||
| * @see https://html.spec.whatwg.org/#script-data-double-escape-start-state |
There was a problem hiding this comment.
| * @see https://html.spec.whatwg.org/#script-data-double-escape-start-state | |
| * @link https://html.spec.whatwg.org/#script-data-double-escape-start-state |
| * A tag name ends only at one of the characters matched below, so text | ||
| * such as `</scriptx>` cannot change that structure and is safe to set. | ||
| * | ||
| * @see https://html.spec.whatwg.org/#script-data-end-tag-name-state |
There was a problem hiding this comment.
| * @see https://html.spec.whatwg.org/#script-data-end-tag-name-state | |
| * @link https://html.spec.whatwg.org/#script-data-end-tag-name-state |
`WP_HTML_Tag_Processor::set_modifiable_text()` rejected any content containing `</` followed by the element's own tag name, even where that sequence cannot close the element. A tag name only ends where one of ` `, `\t`, `\f`, `\r`, `\n`, `/`, or `>` follows it, so text such as `</xmp-tag>` inside an XMP element, or `</scriptx>` inside a SCRIPT element with an unrecognized content type, is ordinary text and round-trips safely. Require that terminating character before rejecting the update. Fixes #65824.
0da1cf3 to
a58274f
Compare
sirreal
left a comment
sirreal
left a comment
There was a problem hiding this comment.
This is great, thank you. I left one bit of feedback, then I think this is ready (it will need to wait for WordPress 7.2).
sirreal
left a comment
sirreal
left a comment
There was a problem hiding this comment.
Thank you!
I think this is ready, pending CI.
If you want to add the adjacent fix, I'd be happy to accept it as well: #12914 (comment)
3 participants
WP_HTML_Tag_Processor::set_modifiable_text()rejects any content containing</followed by the element's own tag name, even where that sequence cannot close the element. This relaxes the check to match the tokenizer.What the problem was:
stripos()substring test rejected safe text such as</xmp-tag>in an XMP element, or</scriptx>in a SCRIPT element with an unrecognized content type.What the fix does:
\t,\f,\r,\n,/, or>before rejecting the update, at both cited sites.Approach and why:
\fis retained even though WP's tokenizer does not currently treat it as a terminator, because browsers do.Trac ticket: https://core.trac.wordpress.org/ticket/65824
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5
Used for: Ticket analysis, tests and PR generates. All changes were reviewed and validated by me.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.