Harden update_block_text_content: void elements and attribute names - #18
Open
saarnilauri wants to merge 1 commit into
Open
Harden update_block_text_content: void elements and attribute names#18saarnilauri wants to merge 1 commit into
saarnilauri wants to merge 1 commit into
Conversation
Two defensive fixes to the text-replacement path: - Void elements (<hr>, <img>, <br>, …) can't contain text, so building <hr>text</hr> for a replace_text on e.g. core/separator produced invalid markup the editor rejects. update_block_text_content() now returns such blocks unchanged (new is_void_element() helper). - Attribute names are re-emitted verbatim from WP_HTML_Tag_Processor in both update_block_text_content() and rebuild_inner_content(). The read-path lexer only excludes whitespace, `=`, `/` and `>` from names, so a stored name could carry quotes; not exploitable (no whitespace or `=` means no attribute breakout), but names that aren't [a-zA-Z0-9:_.-]+ are now skipped rather than reflected. Adds tests: replace_text on a separator leaves it untouched, and standard wrapper attributes survive a text replacement.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small, defensive hardening fixes to the
replace_text/textContentpath.1. Void elements can't hold text (bug)
update_block_text_content()wraps the new text as<tag …>text</tag>for theblock's first tag. When that tag is a void element (
<hr>,<img>,<br>, …)this emits invalid markup, e.g.
replace_texton acore/separatorproduces<hr class="wp-block-separator">text</hr>, which the block editor rejects.The function now returns void-wrapped blocks unchanged, via a small
is_void_element()helper (self-contained list, no WP-version dependency).2. Attribute-name re-emission (hardening)
Both
update_block_text_content()andrebuild_inner_content()re-emitattribute names straight from
WP_HTML_Tag_Processor::get_attribute_names_with_prefix('').The read-path lexer only excludes whitespace,
=,/and>from a name, so astored name could contain quotes. This is not exploitable (without whitespace
or
=there's no attribute breakout, and values are alreadyesc_attr()'d), butnames that don't match
[a-zA-Z0-9:_.-]+are now skipped rather than reflected ,belt-and-braces in case the lexer ever loosens.
Tests
test_update_block_text_content_leaves_void_elements_untouchedfails oncurrent
main(emits<hr>…</hr>), passes with this change.test_update_block_text_content_preserves_attributesconfirms theattribute-name guard doesn't drop standard
class/idattributes.Verified in the wp-env PHPUnit suite: full suite green (107 tests). The
attribute-name change is hardening with no readily reproducible failing case, so
it has no dedicated red test.
Use of AI
The code changes were created with AI agent, the changes reviewed by me. Tests runned by me.