Context Navigation

Changeset 60887

Timestamp:

10/01/2025 12:57:19 PM (7 weeks ago)

Author:

jonsurrell

Message:

HTML API: Ensure non-string HTML input is safely handled.

Prevents an issue where passing null to HTML API constructors could result in runtime errors.

Props kraftbj, jonsurrell, westonruter.
Fixes #63854.

Location:

trunk

Files:

-  r60647
+  r60887
+        }
+        if ( ! is_string( $html ) ) {
+            _doing_it_wrong(
+                __METHOD__,
+                __( 'The HTML parameter must be a string.' ),
+                '6.9.0'
+            );
+            return null;
+        }
         $context_processor = static::create_full_parser( "<!DOCTYPE html>{$context}", $encoding );
         if ( null === $context_processor ) {
 …
     public static function create_full_parser( $html, $known_definite_encoding = 'UTF-8' ) {
         if ( 'UTF-8' !== $known_definite_encoding ) {
+            return null;
+        }
+        if ( ! is_string( $html ) ) {
+            _doing_it_wrong(
+                __METHOD__,
+                __( 'The HTML parameter must be a string.' ),
+                '6.9.0'
+            );
             return null;
+        }

-  r60706
+  r60887
      */
     public function __construct( $html ) {
+        if ( ! is_string( $html ) ) {
+            _doing_it_wrong(
+                __METHOD__,
+                __( 'The HTML parameter must be a string.' ),
+                '6.9.0'
+            );
+            $html = '';
+        }
         $this->html = $html;
+    }

-  r59467
+  r60887
     public function test_warns_that_the_static_creator_methods_should_be_called_instead_of_the_public_constructor() {
         new WP_HTML_Processor( '<p>Light roast.</p>' );
+    }
+    /**
+     * @ticket 63854
+     *
+     * @covers ::create_fragment
+     * @expectedIncorrectUsage WP_HTML_Processor::create_fragment
+     */
+    public function test_create_fragment_validates_html_parameter() {
+        $processor = WP_HTML_Processor::create_fragment( null );
+        $this->assertNull( $processor );
+    }
+    /**
+     * @ticket 63854
+     *
+     * @covers ::create_full_parser
+     * @expectedIncorrectUsage WP_HTML_Processor::create_full_parser
+     */
+    public function test_create_full_parser_validates_html_parameter() {
+        $processor = WP_HTML_Processor::create_full_parser( null );
+        $this->assertNull( $processor );
+    }

-  r60649
+  r60887
             $this->assertFalse( $processor->has_self_closing_flag(), 'Found the self-closing tag when it was absent.' );
+        }
+    }
+    /**
+     * @ticket 63854
+     *
+     * @covers WP_HTML_Tag_Processor::__construct
+     * @expectedIncorrectUsage WP_HTML_Tag_Processor::__construct
+     */
+    public function test_constructor_validates_html_parameter() {
+        // Test that passing null triggers _doing_it_wrong and sets HTML to empty string.
+        $processor = new WP_HTML_Tag_Processor( null );
+        // Verify that the HTML was set to an empty string.
+        $this->assertSame( '', $processor->get_updated_html(), 'HTML should be set to empty string when null is passed' );
+        // Verify that next_token() works without errors (indicating the processor is in a valid state).
+        $this->assertFalse( $processor->next_token(), 'next_token() should work without errors when HTML is empty string' );
+    }

Note: See TracChangeset for help on using the changeset viewer.