Audit `wp_json_encode()` with appropriate JSON flags #9557

BugReportOnWeb · 2025-08-21T09:01:48Z

This patch audits the use of wp_json_encode() where encoded data is used inside script tags/elements and updates those calls to use safer encoding flags (JSON_HEX_TAG and JSON_UNESCAPED_SLASHES)

Trac ticket: https://core.trac.wordpress.org/ticket/63851

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

… tags

github-actions · 2025-08-21T09:18:32Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props devasheeshkaul, jonsurrell.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

sirreal

Thank you! This seems to address the issue in many places. I've reviewed all the changes and they appear correct.

I have one request to add a test case for wp_localize_script functionality. Are you comfortable handling that?

How comprehensive is this audit? I believe there were other usages that included some JSON flags. Did you consider those cases and whether they use appropriate flags, or is this only the cases with no flags?

sirreal · 2025-08-21T12:26:43Z

src/wp-includes/class-wp-scripts.php

 		}

-		$script = "var $object_name = " . wp_json_encode( $l10n ) . ';';
+		$script = "var $object_name = " . wp_json_encode( $l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';


This should fix the wp_localize_script problem mentioned in the ticket.

Will you add a test for wp_localize_script? The assertEqualHTML test helper should work nicely.

Sure, I'll go ahead and add a test. Thank you!

BugReportOnWeb · 2025-08-22T06:09:08Z

How comprehensive is this audit? I believe there were other usages that included some JSON flags. Did you consider those cases and whether they use appropriate flags, or is this only the cases with no flags?

Thank you for the review, @sirreal! Yes, I went through every instance of wp_json_encode() that is (or could be) used inside a script tag. From what I saw, the cases that already had JSON flags were also using the correct ones to prevent this issue.

I'll do another pass to double check all usages and update the patch if I spot anything missed.

github-actions · 2025-08-22T10:48:28Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

The Plugin and Theme Directories cannot be accessed within Playground.
All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

sirreal

Great, this is very close, thanks for the updates! I just have a few minor adjustments I'd like to make before this is ready.

sirreal · 2025-08-26T09:41:09Z

src/wp-includes/class-wp-script-modules.php

 		if ( ! empty( $import_map['imports'] ) ) {
 			wp_print_inline_script_tag(
-				wp_json_encode( $import_map, JSON_HEX_TAG | JSON_HEX_AMP ),
+				wp_json_encode( $import_map, JSON_HEX_TAG | JSON_HEX_AMP | JSON_UNESCAPED_SLASHES ),


I don't think there's any reason to escape JSON_HEX_AMP generally. Let's remove that and be consistent in the usage:

Suggested change

wp_json_encode( $import_map, JSON_HEX_TAG | JSON_HEX_AMP | JSON_UNESCAPED_SLASHES ),

wp_json_encode( $import_map, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),

This was added in [57269], developed in #5818.

The only reason I'm aware of to escape & is for XHTML support, and that should be handled by CDATA wrappers as mentioned in #5818 (comment).

Pinging @luisherranz @swissspidy from the linked conversation in case there are specific concerns about the & character.

tests/phpunit/tests/dependencies/wpLocalizeScript.php

sirreal

This is great, thank you!

`wp_json_encode()` with default arguments is insufficient to safely escape JSON for script tags. Use `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` flags. Developed in #9557. Props devasheeshkaul, jonsurrell, siliconforks. Fixes #63851. git-svn-id: https://develop.svn.wordpress.org/trunk@60681 602fd350-edb4-49c9-b593-d223f7449a82

github-actions · 2025-08-27T10:33:15Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 60681
GitHub commit: 62f89e9

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

`wp_json_encode()` with default arguments is insufficient to safely escape JSON for script tags. Use `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` flags. Developed in WordPress/wordpress-develop#9557. Props devasheeshkaul, jonsurrell, siliconforks. Fixes #63851. Built from https://develop.svn.wordpress.org/trunk@60681 git-svn-id: http://core.svn.wordpress.org/trunk@60017 1a063a9b-81f0-0310-95a4-ce76da25c4cd

`wp_json_encode()` with default arguments is insufficient to safely escape JSON for script tags. Use `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` flags. Developed in WordPress/wordpress-develop#9557. Props devasheeshkaul, jonsurrell, siliconforks. Fixes #63851. Built from https://develop.svn.wordpress.org/trunk@60681 git-svn-id: https://core.svn.wordpress.org/trunk@60017 1a063a9b-81f0-0310-95a4-ce76da25c4cd

`wp_json_encode()` with default arguments is insufficient to safely escape JSON for script tags. Use `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` flags. Developed in WordPress#9557. Props devasheeshkaul, jonsurrell, siliconforks. Fixes #63851. git-svn-id: https://develop.svn.wordpress.org/trunk@60681 602fd350-edb4-49c9-b593-d223f7449a82

Specifically the addition of JSON_UNESCAPED_SLASHES as a flag. See: WordPress/wordpress-develop#9557

fix: audit wp_json_encode with appropriate JSON flags inside script…

0231dbd

… tags

BugReportOnWeb marked this pull request as ready for review August 21, 2025 09:18

sirreal self-requested a review August 21, 2025 12:05

sirreal reviewed Aug 21, 2025

View reviewed changes

BugReportOnWeb added 3 commits August 22, 2025 15:39

test: add test case for checking wp_localize_script for safe JSON output

115e376

fix: add missing JSON flag for safe output

9c5db61

style: fix fomatting as per PHPCS

5c74cc4

BugReportOnWeb requested a review from sirreal August 22, 2025 11:10

sirreal reviewed Aug 26, 2025

View reviewed changes

BugReportOnWeb added 3 commits August 27, 2025 11:37

test: refactor test case for cleaner output

0cece84

fix: remove redundant JSON flags

36ffad5

Merge branch 'trunk' into fix/audit-wp_json_encode

dab63ba

BugReportOnWeb requested a review from sirreal August 27, 2025 08:33

sirreal approved these changes Aug 27, 2025

View reviewed changes

github-actions bot closed this Aug 27, 2025

pattonwebz added a commit to equalizedigital/accessibility-checker that referenced this pull request Dec 2, 2025

Update some tests to account for WP6.9 changes to wp_json_encode flags.

c48ed70

Specifically the addition of JSON_UNESCAPED_SLASHES as a flag. See: WordPress/wordpress-develop#9557

pattonwebz mentioned this pull request Dec 2, 2025

Update some tests to account for WP6.9 changes to wp_json_encode flags. equalizedigital/accessibility-checker#1293

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Audit `wp_json_encode()` with appropriate JSON flags #9557

Audit `wp_json_encode()` with appropriate JSON flags #9557

Uh oh!

BugReportOnWeb commented Aug 21, 2025

Uh oh!

github-actions bot commented Aug 21, 2025 •

edited

Loading

Uh oh!

sirreal left a comment

Uh oh!

sirreal Aug 21, 2025

Uh oh!

BugReportOnWeb Aug 22, 2025

Uh oh!

BugReportOnWeb commented Aug 22, 2025

Uh oh!

github-actions bot commented Aug 22, 2025

Uh oh!

sirreal left a comment

Uh oh!

sirreal Aug 26, 2025

Uh oh!

Uh oh!

Uh oh!

sirreal left a comment

Uh oh!

github-actions bot commented Aug 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	wp_json_encode( $import_map, JSON_HEX_TAG \| JSON_HEX_AMP \| JSON_UNESCAPED_SLASHES ),
	wp_json_encode( $import_map, JSON_HEX_TAG \| JSON_UNESCAPED_SLASHES ),

Audit wp_json_encode() with appropriate JSON flags #9557

Audit wp_json_encode() with appropriate JSON flags #9557

Uh oh!

Conversation

BugReportOnWeb commented Aug 21, 2025

Uh oh!

github-actions bot commented Aug 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sirreal left a comment

Choose a reason for hiding this comment

Uh oh!

sirreal Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

BugReportOnWeb Aug 22, 2025

Choose a reason for hiding this comment

Uh oh!

BugReportOnWeb commented Aug 22, 2025

Uh oh!

github-actions bot commented Aug 22, 2025

Test using WordPress Playground

Some things to be aware of

Uh oh!

sirreal left a comment

Choose a reason for hiding this comment

Uh oh!

sirreal Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sirreal left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Aug 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Audit `wp_json_encode()` with appropriate JSON flags #9557

Audit `wp_json_encode()` with appropriate JSON flags #9557

github-actions bot commented Aug 21, 2025 •

edited

Loading