Skip to content

Commit 10125f8

Browse files
committed
KSES: Normalize closing block delimiter names. (WordPress#14120)
Trac ticket: Core-66208 See WordPress#13271 When `wp_kses()` was refactored, it introduced block name normalization, but only for opening and void block delimiters whose attributes were changed during sanitization. This left semantically-equivalent but mismatched delimiters. This patch enforces normalization for all block names inside block delimiters.
1 parent 7119e1b commit 10125f8

1 file changed

Lines changed: 17 additions & 1 deletion

File tree

‎src/wp-includes/kses.php‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1661,6 +1661,7 @@ public function sanitize() {
16611661
$implicit_block_type = str_starts_with( $block_type, 'core/' )
16621662
? substr( $block_type, /* 'core/' */ 5 )
16631663
: $block_type;
1664+
$make_implicit = $block_type !== $implicit_block_type;
16641665

16651666
switch ( $block_processor->get_delimiter_type() ) {
16661667
// Track when blocks open and when they don’t self-close.
@@ -1691,6 +1692,7 @@ public function sanitize() {
16911692
// Filter block attributes for opening delimiters.
16921693
if ( $block_processor->opens_block() ) {
16931694
$original_attributes = $block_processor->allocate_and_return_parsed_attributes();
1695+
$voider = WP_Block_Processor::VOID === $block_processor->get_delimiter_type() ? '/' : '';
16941696

16951697
if ( isset( $original_attributes ) ) {
16961698
$filtered_attributes = filter_block_kses_value(
@@ -1702,10 +1704,24 @@ public function sanitize() {
17021704

17031705
if ( $original_attributes !== $filtered_attributes ) {
17041706
$serialized_attributes = serialize_block_attributes( $filtered_attributes );
1705-
$voider = WP_Block_Processor::VOID === $block_processor->get_delimiter_type() ? '/' : '';
17061707
$text = " wp:{$implicit_block_type} {$serialized_attributes} {$voider}";
1708+
} elseif ( $make_implicit ) {
1709+
$type_at = strpos( $comment, 'wp:' ) + 3;
1710+
$after_type = $type_at + strlen( $block_type );
1711+
$close_at = strpos( $comment, '-->' );
1712+
1713+
$text = (
1714+
substr( $comment, 0, $type_at ) .
1715+
$implicit_block_type .
1716+
substr( $comment, $after_type, $close_at - $after_type )
1717+
);
17071718
}
1719+
} elseif ( $make_implicit ) {
1720+
$text = " wp:{$implicit_block_type} {$voider}";
17081721
}
1722+
} elseif ( $make_implicit ) {
1723+
// Normalize closing block delimiters too.
1724+
$text = " /wp:{$implicit_block_type} ";
17091725
}
17101726
}
17111727

0 commit comments

Comments
 (0)