HTML API: Escape syntax characters in RCDATA - #13327
Conversation
c3de662 to
686dc5e
Compare
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
sirreal
left a comment
sirreal
left a comment
There was a problem hiding this comment.
This is probably an improvement overall for anything inspecting HTML downstream.
Assume HTML like: <title><foo><bar></title>
There are two obvious ways to mis-parse this:
<foo>treated as a start tag (it's the text<foo>)<bar>not decoded (it's the text<bar>).
This change would eliminate the first category <foo>, while leaving the second category <bar> exactly the same. The tradeoff here is that naive parsers are more likely to confuse the text <foo> for an element, and if they don't correctly handle decoding… well that would already be broken.
I'm in favor of this, it's perfectly valid and correct HTML and simplifies the surface area of HTML trivia that needs to be correctly implemented downstream.
In some related CSS work, I made a similar decision. It's best to remove possibly confusing syntax characters entirely where escaping is possible.
686dc5e to
a772966
Compare
|
I’ve added the comments, updated the code, and added tests verifying the behavior. Assuming those pass I will merge this! |
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
2ea5d13 to
9b177f0
Compare
9b177f0 to
d4ebb79
Compare
Characters in TITLE and TEXTAREA aren’t required to be escaped, but doing so might prevent downstream parsers from mis-parsing content inside of these elements as markup, when in fact they are plaintext. This patch escapes the content by default to prevent such a scenario. Developed in: #13327 Discussed in: https://core.trac.wordpress.org/ticket/65984 Props dmsnell, jonsurrell, westonruter. See #65984. git-svn-id: https://develop.svn.wordpress.org/trunk@63418 602fd350-edb4-49c9-b593-d223f7449a82
Characters in TITLE and TEXTAREA aren’t required to be escaped, but doing so might prevent downstream parsers from mis-parsing content inside of these elements as markup, when in fact they are plaintext. This patch escapes the content by default to prevent such a scenario. Developed in: WordPress/wordpress-develop#13327 Discussed in: https://core.trac.wordpress.org/ticket/65984 Props dmsnell, jonsurrell, westonruter. See #65984. Built from https://develop.svn.wordpress.org/trunk@63418 git-svn-id: http://core.svn.wordpress.org/trunk@62610 1a063a9b-81f0-0310-95a4-ce76da25c4cd
3 participants
Trac ticket: Core-65984
Status
Description
Characters in
TITLEandTEXTAREAaren’t required to be escaped, but doing so might prevent downstream parsers from mis-parsing content inside of these elements as markup, when in fact they are plaintext.This patch escapes the content by default to prevent such a scenario.