jonsurrell d4a1644618 HTML API: Prevent adding dangerous double-escape SCRIPT contents. ...

Prevent WP_Tag_Processor::set_modifiable_text() from allowing SCRIPT contents with "<script" like it does with "</script". Either of these sequences may affect the script element's close.

Developed in https://github.com/WordPress/wordpress-develop/pull/9560.

Props jonsurrell, westonruter, dmsnell.
See #63738.

Built from https://develop.svn.wordpress.org/trunk@60706


git-svn-id: http://core.svn.wordpress.org/trunk@60042 1a063a9b-81f0-0310-95a4-ce76da25c4cd

2025-09-04 14:40:27 +00:00

..

class-wp-html-active-formatting-elements.php

…

class-wp-html-attribute-token.php

…

class-wp-html-decoder.php

…

class-wp-html-doctype-info.php

HTML API: Fix typo in indicated_compatibility_mode.

2025-08-19 15:08:31 +00:00

class-wp-html-open-elements.php

HTML API: Ensure that full processor can seek to earlier bookmarks.

2024-11-12 10:32:17 +00:00

class-wp-html-processor-state.php

HTML API: Remove unused processor state context_node property

2024-11-27 09:54:17 +00:00

class-wp-html-processor.php

HTML API: Fix typo in indicated_compatibility_mode.

2025-08-19 15:08:31 +00:00

class-wp-html-span.php

…

class-wp-html-stack-event.php

…

class-wp-html-tag-processor.php

HTML API: Prevent adding dangerous double-escape SCRIPT contents.

2025-09-04 14:40:27 +00:00

class-wp-html-text-replacement.php

…

class-wp-html-token.php

…

class-wp-html-unsupported-exception.php

…

html5-named-character-references.php

…