Skip to content

Handle non-string values in WP_HTML_Tag_Processor #9545

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 8 commits into from
Closed

Handle non-string values in WP_HTML_Tag_Processor #9545

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a10ab72
Handle non-string values in WP_HTML_Tag_Processor
kraftbj Aug 20, 2025
1549291
Trac ticket number
kraftbj Aug 22, 2025
e366ee3
Remove the since annotation
kraftbj Aug 22, 2025
96343a3
Merge remote-tracking branch 'origin/trunk' into update/html-tag-proe…
kraftbj Sep 30, 2025
884dc04
Defensive coding for non-strings in ::create_fragment and ::create_fu…
kraftbj Sep 30, 2025
8d2adae
Add HTML processor doing it wrong tests
sirreal Oct 1, 2025
d27eb39
Use expectedIncorrectUsage test annotation over method
sirreal Oct 1, 2025
870a819
Merge branch 'trunk' into update/html-tag-proecssor-null
sirreal Oct 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions src/wp-includes/html-api/class-wp-html-processor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,15 @@ public static function create_fragment( $html, $context = '<body>', $encoding =
return null;
}

if ( ! is_string( $html ) ) {
_doing_it_wrong(
__METHOD__,
__( 'The HTML parameter must be a string.' ),
'6.9.0'
);
return null;
}

$context_processor = static::create_full_parser( "<!DOCTYPE html>{$context}", $encoding );
if ( null === $context_processor ) {
return null;
Expand Down Expand Up @@ -339,6 +348,14 @@ public static function create_full_parser( $html, $known_definite_encoding = 'UT
if ( 'UTF-8' !== $known_definite_encoding ) {
return null;
}
if ( ! is_string( $html ) ) {
_doing_it_wrong(
__METHOD__,
__( 'The HTML parameter must be a string.' ),
'6.9.0'
);
return null;
}

$processor = new static( $html, self::CONSTRUCTOR_UNLOCK_CODE );
$processor->state->encoding = $known_definite_encoding;
Expand Down
8 changes: 8 additions & 0 deletions src/wp-includes/html-api/class-wp-html-tag-processor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -834,6 +834,14 @@ class WP_HTML_Tag_Processor {
* @param string $html HTML to process.
*/
public function __construct( $html ) {
if ( ! is_string( $html ) ) {
_doing_it_wrong(
__METHOD__,
__( 'The HTML parameter must be a string.' ),
'6.9.0'
);
$html = '';
}
$this->html = $html;
}

Expand Down
22 changes: 22 additions & 0 deletions tests/phpunit/tests/html-api/wpHtmlProcessor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,28 @@ public function test_warns_that_the_static_creator_methods_should_be_called_inst
new WP_HTML_Processor( '<p>Light roast.</p>' );
}

/**
* @ticket 63854
*
* @covers ::create_fragment
* @expectedIncorrectUsage WP_HTML_Processor::create_fragment
*/
public function test_create_fragment_validates_html_parameter() {
$processor = WP_HTML_Processor::create_fragment( null );
$this->assertNull( $processor );
}

/**
* @ticket 63854
*
* @covers ::create_full_parser
* @expectedIncorrectUsage WP_HTML_Processor::create_full_parser
*/
public function test_create_full_parser_validates_html_parameter() {
$processor = WP_HTML_Processor::create_full_parser( null );
$this->assertNull( $processor );
}

/**
* Once stepping to the end of the document, WP_HTML_Processor::get_tag
* should no longer report a tag. It should report `null` because there
Expand Down
17 changes: 17 additions & 0 deletions tests/phpunit/tests/html-api/wpHtmlTagProcessor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,23 @@ public function test_has_self_closing_flag_matches_input_html( $html, $flag_is_s
}
}

/**
* @ticket 63854
*
* @covers WP_HTML_Tag_Processor::__construct
* @expectedIncorrectUsage WP_HTML_Tag_Processor::__construct
*/
public function test_constructor_validates_html_parameter() {
// Test that passing null triggers _doing_it_wrong and sets HTML to empty string.
$processor = new WP_HTML_Tag_Processor( null );

// Verify that the HTML was set to an empty string.
$this->assertSame( '', $processor->get_updated_html(), 'HTML should be set to empty string when null is passed' );

// Verify that next_token() works without errors (indicating the processor is in a valid state).
$this->assertFalse( $processor->next_token(), 'next_token() should work without errors when HTML is empty string' );
}

/**
* Data provider. HTML tags which might have a self-closing flag, and an indicator if they do.
*
Expand Down
Loading