Fix inline script tag escaping #14

sirreal · 2025-07-23T18:58:08Z

Trac ticket:

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

src/wp-includes/functions.wp-scripts.php

Copilot

Pull Request Overview

This pull request fixes inline script tag escaping to prevent script injection vulnerabilities when embedding data in HTML script tags. The changes improve security by properly escaping dangerous patterns that could break out of script contexts.

Implements proper escaping for script tag content that could close or interfere with script elements
Adds comprehensive detection of JavaScript vs non-JavaScript script tags based on HTML specification
Updates inline script functions to use the new HTML Tag Processor for safe content handling

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`src/wp-includes/html-api/class-wp-html-tag-processor.php`	Adds JavaScript script tag detection and Unicode escaping for dangerous patterns
`src/wp-includes/script-loader.php`	Updates inline script generation to use HTML Tag Processor for safe escaping
`src/wp-includes/functions.wp-scripts.php`	Improves script tag detection and content extraction using HTML Tag Processor
`src/wp-includes/block-editor.php`	Adds JSON_UNESCAPED_SLASHES flag to prevent double-escaping of slashes
`tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php`	Adds comprehensive test coverage for script tag escaping scenarios
`tests/phpunit/tests/blocks/editor.php`	Updates test expectations and adds security test for script tag closure

Copilot · 2025-08-06T11:13:13Z

src/wp-includes/html-api/class-wp-html-tag-processor.php

+	 *
+	 * @see https://html.spec.whatwg.org/multipage/scripting.html#prepare-the-script-element
+	 *
+	 * @since {WP_VERSION}


The @SInCE tag contains a placeholder '{WP_VERSION}' instead of an actual version number. This should be replaced with the specific WordPress version when this feature is released.

Suggested change

* @since {WP_VERSION}

* @since 6.5.0

Copilot · 2025-08-06T11:13:14Z

src/wp-includes/html-api/class-wp-html-tag-processor.php

+					 * JavaScript can be safely escaped.
+					 * Non-JavaScript script tags have unknown semantics.
+					 *
+					 * @todo consider applying to JSON and importmap script tags as well.


This TODO comment suggests unfinished work. Consider either implementing the suggested feature for JSON and importmap script tags or removing this comment if it's not planned for this release.

Suggested change

* @todo consider applying to JSON and importmap script tags as well.

Copilot · 2025-08-06T11:13:14Z

tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php

+			'Tricky script open tag with \r'        => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\\u0073cript\r></script>" ),
+			'Tricky script open tag with \r\n'      => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\\u0073cript\r\n></script>" ),
+			'Tricky script close tag with \r'       => array( '<script></script>', "// </script\r>", "<script>// </\\u0073cript\r></script>" ),
+			'Tricky script close tag with \r\n'     => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),


The expected output contains double backslashes '\u0073' which appears incorrect. It should be '\u0073' (single backslash) to represent the Unicode escape sequence properly.

Suggested change

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),

'Tricky script open tag with \r' => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\u0073cript\r></script>" ),

'Tricky script open tag with \r\n' => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\u0073cript\r\n></script>" ),

'Tricky script close tag with \r' => array( '<script></script>', "// </script\r>", "<script>// </\u0073cript\r></script>" ),

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\u0073cript\r\n></script>" ),

Copilot · 2025-08-06T11:13:14Z

tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php

+			'Tricky script open tag with \r'        => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\\u0073cript\r></script>" ),
+			'Tricky script open tag with \r\n'      => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\\u0073cript\r\n></script>" ),
+			'Tricky script close tag with \r'       => array( '<script></script>', "// </script\r>", "<script>// </\\u0073cript\r></script>" ),
+			'Tricky script close tag with \r\n'     => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),


The expected output contains double backslashes '\u0073' which appears incorrect. It should be '\u0073' (single backslash) to represent the Unicode escape sequence properly.

Suggested change

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),

'Tricky script open tag with \r' => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\u0073cript\r></script>" ),

'Tricky script open tag with \r\n' => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\u0073cript\r\n></script>" ),

'Tricky script close tag with \r' => array( '<script></script>', "// </script\r>", "<script>// </\u0073cript\r></script>" ),

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\u0073cript\r\n></script>" ),

Copilot · 2025-08-06T11:13:14Z

tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php

+			'Tricky script open tag with \r'        => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\\u0073cript\r></script>" ),
+			'Tricky script open tag with \r\n'      => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\\u0073cript\r\n></script>" ),
+			'Tricky script close tag with \r'       => array( '<script></script>', "// </script\r>", "<script>// </\\u0073cript\r></script>" ),
+			'Tricky script close tag with \r\n'     => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),


The expected output contains double backslashes '\u0073' which appears incorrect. It should be '\u0073' (single backslash) to represent the Unicode escape sequence properly.

Suggested change

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),

'Tricky script open tag with \r' => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\u0073cript\r></script>" ),

'Tricky script open tag with \r\n' => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\u0073cript\r\n></script>" ),

'Tricky script close tag with \r' => array( '<script></script>', "// </script\r>", "<script>// </\u0073cript\r></script>" ),

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\u0073cript\r\n></script>" ),

Copilot · 2025-08-06T11:13:15Z

tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php

+			'Tricky script open tag with \r'        => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\\u0073cript\r></script>" ),
+			'Tricky script open tag with \r\n'      => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\\u0073cript\r\n></script>" ),
+			'Tricky script close tag with \r'       => array( '<script></script>', "// </script\r>", "<script>// </\\u0073cript\r></script>" ),
+			'Tricky script close tag with \r\n'     => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),


The expected output contains double backslashes '\u0073' which appears incorrect. It should be '\u0073' (single backslash) to represent the Unicode escape sequence properly.

Suggested change

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),

'Tricky script open tag with \r' => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\u0073cript\r></script>" ),

'Tricky script open tag with \r\n' => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\u0073cript\r\n></script>" ),

'Tricky script close tag with \r' => array( '<script></script>', "// </script\r>", "<script>// </\u0073cript\r></script>" ),

'Tricky script close tag with \r\n' => array( '<script></script>', "// </script\r\n>", "<script>// </\u0073cript\r\n></script>" ),

src/wp-includes/html-api/class-wp-html-tag-processor.php

sirreal · 2025-11-28T10:53:11Z

src/wp-includes/html-api/class-wp-html-tag-processor.php

+					 */
+					if ( $this->is_javascript_script_tag() ) {
+						$plaintext_content = preg_replace_callback(
+							'~<(/?)(s)(cript)([\t\r\n\f />])~i',


We're only interested in 3 parts:

Leading

s or S (relevant)

trailing

Fewer groups and later concats.

This ensures that not only the return values match the expected results, but also that their type is the same. Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable. Follow-up to [61032], [61045]. See #64324. git-svn-id: https://develop.svn.wordpress.org/trunk@61373 602fd350-edb4-49c9-b593-d223f7449a82

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-12T22:44:57Z

tests/phpunit/tests/html-api/wpHtmlTagProcessorModifiableText.php

+
+
+	/**
+	 * @ticket TBD


The ticket number is marked as "TBD" (To Be Determined). This should be replaced with the actual WordPress Trac ticket number before merging.

Suggested change

* @ticket TBD

* @ticket 62835

Copilot · 2025-12-12T22:44:57Z

tests/phpunit/tests/dependencies/scripts.php

 	}
+
+	/**
+	 * @ticket TBD


The ticket number is marked as "TBD" (To Be Determined). This should be replaced with the actual WordPress Trac ticket number before merging.

Copilot · 2025-12-12T22:44:58Z

tests/phpunit/tests/dependencies/scripts.php

+	}
+
+	/**
+	 * @ticket TBD


The ticket number is marked as "TBD" (To Be Determined). This should be replaced with the actual WordPress Trac ticket number before merging.

Suggested change

* @ticket TBD

* @ticket 12345

Copilot · 2025-12-12T22:44:58Z

src/wp-includes/html-api/class-wp-html-tag-processor.php

+	/**
+	 * Indicates if the currently matched tag is a JSON script tag.
+	 *
+	 * @since {WP_VERSION}


The @SInCE tag contains a placeholder "{WP_VERSION}" that should be replaced with the actual WordPress version number (e.g., "6.8.0") before merging.

Suggested change

* @since {WP_VERSION}

* @since 6.8.0

…nzip_file` filters. This commit ensures that the original `$file` argument passed to the function is not unintentionally overwritten by the use of the same variable name in two `foreach` loops. Follow-up to [56689]. Props sanchothefat, westonruter, mukesh27, SergeyBiryukov. Fixes #64398. git-svn-id: https://develop.svn.wordpress.org/trunk@61374 602fd350-edb4-49c9-b593-d223f7449a82

Fixes PHPCS warning: `Squiz.WhiteSpace.SuperfluousWhitespace.EndLine`. Follow-up to [61374]. See #64398. git-svn-id: https://develop.svn.wordpress.org/trunk@61375 602fd350-edb4-49c9-b593-d223f7449a82

… when invalid taxonomy supplied. Developed in WordPress#10621 Props owolter, westonruter. Fixes #64406. git-svn-id: https://develop.svn.wordpress.org/trunk@61376 602fd350-edb4-49c9-b593-d223f7449a82

This ensures that the `url` parameter is not marked as invalid due to `wp_http_validate_url()` failing because of a `gethostbyname()` failure. Follow-up to [51973]. Props westonruter, swissspidy. See #54358. Fixes #64412. git-svn-id: https://develop.svn.wordpress.org/trunk@61377 602fd350-edb4-49c9-b593-d223f7449a82

…tick` may fire before `DOMContentLoaded`. Developed in WordPress#10624 Follow-up to [23805], [50547]. Props westonruter, ArtZ91, siliconforks. See #23295. Fixes #64403. git-svn-id: https://develop.svn.wordpress.org/trunk@61379 602fd350-edb4-49c9-b593-d223f7449a82

…ency. Follow-up to [19687], [41746]. See #64224. git-svn-id: https://develop.svn.wordpress.org/trunk@61380 602fd350-edb4-49c9-b593-d223f7449a82

This helps demonstrate the effectiveness.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

These tricky sequences do terminate a tag name because they are handled when normalizing newlines in pre-processing (before tokenization).

Add regex pattern explanation

sirreal force-pushed the fix/62797-inline-script-tag-escape-alternate branch 2 times, most recently from 3052284 to 4b9aa42 Compare July 30, 2025 08:03

sirreal commented Jul 30, 2025

View reviewed changes

src/wp-includes/functions.wp-scripts.php Outdated Show resolved Hide resolved

sirreal requested a review from Copilot July 30, 2025 16:54

This comment was marked as outdated.

Sign in to view

sirreal requested a review from Copilot July 30, 2025 19:32

This comment was marked as outdated.

Sign in to view

sirreal requested a review from Copilot July 30, 2025 21:23

This comment was marked as outdated.

Sign in to view

sirreal requested a review from Copilot August 6, 2025 11:11

Copilot AI reviewed Aug 6, 2025

View reviewed changes

sirreal commented Nov 28, 2025

View reviewed changes

src/wp-includes/html-api/class-wp-html-tag-processor.php Outdated Show resolved Hide resolved

sirreal commented Nov 28, 2025

View reviewed changes

sirreal force-pushed the fix/62797-inline-script-tag-escape-alternate branch from d58831e to 410089d Compare December 12, 2025 18:36

sirreal force-pushed the fix/62797-inline-script-tag-escape-alternate branch from 8b87248 to e4679ca Compare December 12, 2025 22:34

sirreal requested a review from Copilot December 12, 2025 22:35

Copilot started reviewing on behalf of sirreal December 12, 2025 22:35 View session

Copilot AI reviewed Dec 12, 2025

View reviewed changes

SergeyBiryukov and others added 11 commits December 13, 2025 20:10

Coding Standards: Remove whitespace at end of line.

048ea74

Fixes PHPCS warning: `Squiz.WhiteSpace.SuperfluousWhitespace.EndLine`. Follow-up to [61374]. See #64398. git-svn-id: https://develop.svn.wordpress.org/trunk@61375 602fd350-edb4-49c9-b593-d223f7449a82

Taxonomy: Avoid type error in wp_delete_object_term_relationships()…

355672f

… when invalid taxonomy supplied. Developed in WordPress#10621 Props owolter, westonruter. Fixes #64406. git-svn-id: https://develop.svn.wordpress.org/trunk@61376 602fd350-edb4-49c9-b593-d223f7449a82

Docs: Update wp_get_media_creation_timestamp() DocBlock for consist…

eda8d9d

…ency. Follow-up to [19687], [41746]. See #64224. git-svn-id: https://develop.svn.wordpress.org/trunk@61380 602fd350-edb4-49c9-b593-d223f7449a82

Escape script modifiable text

0d12267

Stop escaping slashes, json_encode dangerously

3dfb7ff

This helps demonstrate the effectiveness.

Use the tag processor to correctly extract script tag contents

a95a0f6

Use the tag processor to correctly set script tag contents

d578529

Improve closing script tag test

d39ba61

sirreal and others added 18 commits December 15, 2025 20:02

Fix failing tests

2d7ba09

Add dangerous script escaping tests

a4265e9

Improve script tag check

eb94e7e

Improve comment about script tag contents

0e0229c

Improve script tag test and sanitization

e63742c

Revert initial regex search

02eed53

Add and improve tests

663fcaf

Fix boolean => bool return type

1d8bc27

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Fix and improve tag processor comments

693673a

Improve and add tests

8a37cc7

Add tests for \r and \r\n

ae22995

These tricky sequences do terminate a tag name because they are handled when normalizing newlines in pre-processing (before tokenization).

Minimize groups and string interpolation

ac3cff5

Add regex pattern explanation

Add general escaping to JSON tags

3cc598c

Clean up escaping contents

5357ad0

Add wp_add_inline_script gnarly tests

7e31aef

Use TBD ticket

ddef71d

Add test for JSON escaping

49a6c81

Explain simple JSON escaping

8cf2527

sirreal force-pushed the fix/62797-inline-script-tag-escape-alternate branch from 1953d44 to 8cf2527 Compare December 15, 2025 19:02

-			'Tricky script close tag with \r\n'     => array( '<script></script>', "// </script\r\n>", "<script>// </\\u0073cript\r\n></script>" ),
+			'Tricky script open tag with \r'        => array( '<script></script>', "<!-- <script\r>", "<script><!-- <\u0073cript\r></script>" ),
+			'Tricky script open tag with \r\n'      => array( '<script></script>', "<!-- <script\r\n>", "<script><!-- <\u0073cript\r\n></script>" ),
+			'Tricky script close tag with \r'       => array( '<script></script>', "// </script\r>", "<script>// </\u0073cript\r></script>" ),
+			'Tricky script close tag with \r\n'     => array( '<script></script>', "// </script\r\n>", "<script>// </\u0073cript\r\n></script>" ),

Fix inline script tag escaping #14

Are you sure you want to change the base?

Fix inline script tag escaping #14

Uh oh!

Conversation

sirreal commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Aug 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sirreal Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sirreal commented Jul 23, 2025 •

edited

Loading