Commit ed9ef86
committed
HTML API: Escape script tag contents automatically.
When setting JavaScript or JSON script tag content, automatically escape sequences like `<script>` and `</script>`. This renders the content safe for HTML. The semantics of any JSON and virtually any JavaScript are preserved.
Script type detection follows the HTML standard for identifying JavaScript and JSON script tags. Other script types continue to reject potentially dangerous content.
Developed in WordPress/wordpress-develop#10635.
Props jonsurrell, dmsnell, westonruter.
Fixes #64419. See #63851, #51159.
Built from https://develop.svn.wordpress.org/trunk@61477
git-svn-id: http://core.svn.wordpress.org/trunk@60789 1a063a9b-81f0-0310-95a4-ce76da25c4cd1 parent 1b2fc4f commit ed9ef86
3 files changed
Lines changed: 395 additions & 46 deletions
File tree
- wp-includes
- html-api
- js/dist/script-modules
0 commit comments