Fix Page List block HTML rendering in editor #73614
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
getdave
added
[Type] Bug
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Contributor
Author
|
I just noticed, I think there's an inconsistency in the PHP frontend code:
Should we also fix this inconsistency? We could remove |
|
Size Change: +35 B (0%) Total Size: 2.54 MB
ℹ️ View Unchanged
|
|
Flaky tests detected in cb33217. 🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/19734481992
|
mikachan
reviewed
Nov 27, 2025
Member
mikachan
left a comment
mikachan
left a comment
There was a problem hiding this comment.
The code changes look good, especially in comparison to the other blocks like block-list/block.js.
This is also testing well for me. I've tried several different tags, and I can verify that they're displaying as raw markup in the Editor on trunk, but with this PR they are rendered as HTML, and they are displayed the same as on the front end.
| Editor on trunk | Editor on this PR | Front end |
|---|---|---|
 |
 |
 |
<em> tag:
<small> tag:
The test file also looks good, and is testing both HTML markup and entities.
Line 207 (button): Uses esc_html( $title ) - double-escapes the already-sanitized HTML, so
<strong>shows as text
I also noticed this, and my vote would be to remove esc_html() from line 207, as the title is already sanitized. It's a small change so I think it would be fine to include as part of this PR.
scruffian
approved these changes
Nov 27, 2025
Contributor
scruffian
left a comment
scruffian
left a comment
There was a problem hiding this comment.
The fix looks good to me. It is possible to add HTML tags to page names and have them outputted in the editor. However that's already possible in the frontend, so I don't think this introduces any vulnerabilities.
Contributor
Author
@scruffian
@mikachan I think to be safe I'll put it in a followup just so it's easy to isolate if it causes any knock on effects that folks weren't expecting. |
Contributor
Author
|
@mikachan @scruffian Follow up in #73641 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What
Fixes #38733. The Page List block now renders HTML formatting and entities in page titles in the editor, matching the frontend behavior. Previously, HTML tags like
<strong>and entity codes like&were displayed as raw markup instead of being rendered.Why
The Page List block was using
decodeEntities()which only decodes HTML entities but doesn't render HTML tags. This caused a mismatch between the editor (showing raw markup) and the frontend (rendering HTML correctly). The fix aligns the editor with the frontend by usingRawHTMLwithsafeHTML, following the same pattern used in other blocks likemissing/edit.jsandblock-list/block.jsfor rendering sanitized HTML in read-only contexts.How
page-list-item/edit.jsto useRawHTMLwithsafeHTMLinstead ofdecodeEntities()for rendering page titles<strong>correctlypage-list.spec.jsfile to verify HTML formatting and entities are rendered correctlyTesting Instructions
<strong>Bold Title</strong>or&"qwerty"—)<strong>tags)¬&)Screenshot