Skip to content

Commit 62f89e9

Browse files
sirrealsirreal
committed
Scripts: Use appropriate JSON encoding flags for script tags.
`wp_json_encode()` with default arguments is insufficient to safely escape JSON for script tags. Use `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` flags. Developed in #9557. Props devasheeshkaul, jonsurrell, siliconforks. Fixes #63851. git-svn-id: https://develop.svn.wordpress.org/trunk@60681 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 7289643 commit 62f89e9

36 files changed

+118
-90
lines changed

‎src/wp-admin/async-upload.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@
145145
$_FILES['async-upload']['name']
146146
);
147147

148-
echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
148+
echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
149149
exit;
150150
}
151151

‎src/wp-admin/customize.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
?>
6363
<?php wp_print_scripts( array( 'wp-util' ) ); ?>
6464
<script>
65-
wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args ); ?> );
65+
wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
6666
</script>
6767
<?php
6868
$script = ob_get_clean();
@@ -158,7 +158,7 @@
158158
<title><?php echo esc_html( $admin_title ); ?></title>
159159

160160
<script type="text/javascript">
161-
var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ) ); ?>,
161+
var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>,
162162
pagenow = 'customize';
163163
</script>
164164

‎src/wp-admin/edit-form-blocks.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ static function ( $classes ) {
115115

116116
wp_add_inline_script(
117117
'wp-blocks',
118-
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ) ) ),
118+
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
119119
'after'
120120
);
121121

@@ -144,7 +144,7 @@ static function ( $classes ) {
144144
// Preload server-registered block schemas.
145145
wp_add_inline_script(
146146
'wp-blocks',
147-
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
147+
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
148148
);
149149

150150
// Preload server-registered block bindings sources.
@@ -158,7 +158,7 @@ static function ( $classes ) {
158158
'usesContext' => $source->uses_context,
159159
);
160160
}
161-
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
161+
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
162162
wp_add_inline_script(
163163
'wp-blocks',
164164
$script
@@ -178,7 +178,7 @@ static function ( $classes ) {
178178
);
179179
wp_add_inline_script(
180180
'wp-editor',
181-
sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url ) ),
181+
sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
182182
'before'
183183
);
184184

@@ -364,8 +364,8 @@ static function ( $classes ) {
364364
$init_script,
365365
$post->post_type,
366366
$post->ID,
367-
wp_json_encode( $editor_settings ),
368-
wp_json_encode( $initial_edits )
367+
wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
368+
wp_json_encode( $initial_edits, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
369369
);
370370
wp_add_inline_script( 'wp-edit-post', $script );
371371

‎src/wp-admin/includes/class-wp-internal-pointers.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ private static function print_js( $pointer_id, $selector, $args ) {
120120
?>
121121
<script type="text/javascript">
122122
(function($){
123-
var options = <?php echo wp_json_encode( $args ); ?>, setup;
123+
var options = <?php echo wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>, setup;
124124

125125
if ( ! options )
126126
return;

‎src/wp-admin/includes/class-wp-list-table.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1871,6 +1871,6 @@ public function _js_vars() {
18711871
),
18721872
);
18731873

1874-
printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args ) );
1874+
printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
18751875
}
18761876
}

‎src/wp-admin/includes/class-wp-privacy-policy-content.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -348,7 +348,7 @@ public static function notice( $post = null ) {
348348
sprintf(
349349
'wp.data.dispatch( "core/notices" ).createWarningNotice( "%s", { actions: [ %s ], isDismissible: false } )',
350350
$message,
351-
wp_json_encode( $action )
351+
wp_json_encode( $action, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
352352
),
353353
'after'
354354
);

‎src/wp-admin/includes/class-wp-themes-list-table.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,7 @@ public function _js_vars( $extra_args = array() ) {
357357
$args = array_merge( $args, $extra_args );
358358
}
359359

360-
printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args ) );
360+
printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
361361
parent::_js_vars();
362362
}
363363
}

‎src/wp-admin/includes/media.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ function media_send_to_editor( $html ) {
274274
?>
275275
<script type="text/javascript">
276276
var win = window.dialogArguments || opener || parent || top;
277-
win.send_to_editor( <?php echo wp_json_encode( $html ); ?> );
277+
win.send_to_editor( <?php echo wp_json_encode( $html, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
278278
</script>
279279
<?php
280280
exit;
@@ -2236,7 +2236,7 @@ function media_upload_form( $errors = null ) {
22362236

22372237
?>
22382238
var resize_height = <?php echo $large_size_h; ?>, resize_width = <?php echo $large_size_w; ?>,
2239-
wpUploaderInit = <?php echo wp_json_encode( $plupload_init ); ?>;
2239+
wpUploaderInit = <?php echo wp_json_encode( $plupload_init, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
22402240
</script>
22412241

22422242
<div id="plupload-upload-ui" class="hide-if-no-js">

‎src/wp-admin/includes/misc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1085,7 +1085,7 @@ function wp_color_scheme_settings() {
10851085
);
10861086
}
10871087

1088-
echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ) ) . ";</script>\n";
1088+
echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ";</script>\n";
10891089
}
10901090

10911091
/**

‎src/wp-admin/includes/options.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ function options_general_add_js() {
3737
jQuery( function($) {
3838
var $siteName = $( '#wp-admin-bar-site-name' ).children( 'a' ).first(),
3939
$siteIconPreview = $('#site-icon-preview-site-title'),
40-
homeURL = ( <?php echo wp_json_encode( get_home_url() ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );
40+
homeURL = ( <?php echo wp_json_encode( get_home_url(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );
4141

4242
$( '#blogname' ).on( 'input', function() {
4343
var title = $.trim( $( this ).val() ) || homeURL;

0 commit comments

Comments
 (0)