HTML API: Auto-escape JavaScript and JSON script tag contents when necessary - #10635

Closed

sirreal wants to merge 73 commits into

WordPress:trunkfrom

sirreal:html-api/auto-escape-javascript-json

Commits on Dec 15, 2025

Auto-escape JavaScript and JSON script tags when necessary
sirreal
committed
4a8ca98
Update ticket number
sirreal
committed
4a28ef2
Fix those lints
sirreal
committed
0bef687
No trailing function commas
sirreal
committed
cdba027
Remove JSON_THROW_ON_ERROR constant
sirreal
committed
ba54ae4
fixup! Remove JSON_THROW_ON_ERROR constant
sirreal
committed
a697e9e

Commits on Dec 16, 2025

Merge branch 'trunk' into html-api/auto-escape-javascript-json
sirreal
committed
2b3d0d0
Remove JSON +json subtype handling
sirreal
committed
8246439

Commits on Dec 19, 2025

Merge branch 'trunk' into html-api/auto-escape-javascript-json
sirreal
committed
3f7f227
Add JS and JSON script tag tests
Copilot
authored
1362451
Fix typo in comment

sirreal
and
westonruter
authored
8d30680
Improve comment
sirreal
committed
3b5ef4e
Clean up and fix tests
sirreal
committed
f8cfdf9
Clean up and improve type/language logic
sirreal
committed
501d201
Fix svg SCRIPT tag tests
sirreal
committed
bcc02ae
Add todo on MIME type parsing
sirreal
committed
ea03441
Update since tags 🤞
sirreal
committed
c7d1827
Make is_{javascript,json}_script_tag methods private
sirreal
committed
a134e82
Add language whitespace test
sirreal
committed
d4bd4b3
How'd that extra space get there, remove it!
sirreal
committed
edae8d5
Name search parts
sirreal
committed
02ca3c0
Clean up escaping tests
sirreal
committed
d058a78
Add ignore and todo tags to new private is_*_script_tag functions
sirreal
committed
dfb63af
Improve example comment
sirreal
committed
11f51c9
Update regex comment with named groups
sirreal
committed
a3e0e27
Add details to "other" failure to escape comment
sirreal
committed
288b952
Improve consistency of comment quoting and differentiate types of double quotes
sirreal
committed
a7495dd
Describe JavaScript escaping strategy in detail
sirreal
committed
d8c320c
Use the updated_html value in round-trip test
sirreal
committed
369eefc

Commits on Dec 22, 2025

Merge branch 'trunk' into html-api/auto-escape-javascript-json
sirreal
committed
55d4e47
Fix demonstration comment
sirreal
committed
2ef0bf0
Extract and document escaping functions
sirreal
committed
cb6b990
Tweak workaround documentation
sirreal
committed
e399bf6
Add ASCII chart about HTML script tags with original source
sirreal
committed
83c1fab
Improve linking between escapes
sirreal
committed
1872681
Fix comments, typos, lints
sirreal
committed
83ff62f
fixup! Fix comments, typos, lints
sirreal
committed
5979782
fixup! fixup! Fix comments, typos, lints
sirreal
committed
d469ae4
Fix \c -> \r (carriage return) typo
sirreal
committed
402ae9f
Add note about not parsing MIME types for JS script tags
sirreal
committed
6b2c9ba
Add todo comment to is_json_script_tag
sirreal
committed
eef0ccb
Re-order tag name termination chars to match elsewhere
sirreal
committed
71d2686
Fix typo
sirreal
committed
d4693a2

Commits on Dec 29, 2025

Commits on Dec 30, 2025

Commits on Jan 8, 2026

Commits on Jan 9, 2026

Commits on Jan 12, 2026

Merge branch 'trunk' into html-api/auto-escape-javascript-json
sirreal
committed
30d7747
Merge branch 'trunk' into html-api/auto-escape-javascript-json
sirreal
committed
c1c6067
Update dot script to clean up fonts, align labels, etc...

dmsnell
authored and
sirreal
committed
3f1ba32
Update note in `set_modifiable_text()` now that `</script` is allowed
dmsnell
committed
f7715fd
Inline escaping to avoid WPCS-mandated misalignment.
dmsnell
committed
1015ace
Expand the explanation for why other strings are rejected
dmsnell
committed
59ccdc1
Explain that there are non-HTML SCRIPT tags.
dmsnell
committed
ef34aa1
Wording changes to comment.
dmsnell
committed
d018cdf

Commits on Jan 13, 2026