mirror of
https://github.com/WordPress/WordPress.git
synced 2024-12-23 01:27:36 +01:00
Security: add Content-Security-Policy script loaders.
Add new functions `wp_get_script_tag`, `wp_print_script_tag`, `wp_print_inline_script_tag` and `wp_get_inline_script_tag` that support script attributes. Enables passing attributes such as `async` or `nonce`, creating a path forward for enabling a Content-Security-Policy in core, plugins and themes. Props tomdxw, johnbillion, jadeddragoon, jrchamp, mallorydxw, epicfaace, alinod, enricocarraro, ocean90. Fixes #39941. Built from https://develop.svn.wordpress.org/trunk@50167 git-svn-id: http://core.svn.wordpress.org/trunk@49846 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
d9cb5af64e
commit
a506e02edd
@ -7866,3 +7866,123 @@ function is_php_version_compatible( $required ) {
|
||||
function wp_fuzzy_number_match( $expected, $actual, $precision = 1 ) {
|
||||
return abs( (float) $expected - (float) $actual ) <= $precision;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sanitizes an attributes array into an attributes string to be placed inside a `<script>` tag.
|
||||
*
|
||||
* Automatically injects type attribute if needed.
|
||||
* Used by {@see wp_get_script_tag()} and {@see wp_get_inline_script_tag()}.
|
||||
*
|
||||
* @since 5.7.0
|
||||
*
|
||||
* @param array $attributes Key-value pairs representing `<script>` tag attributes.
|
||||
* @return string String made of sanitized `<script>` tag attributes.
|
||||
*/
|
||||
function wp_sanitize_script_attributes( $attributes ) {
|
||||
$html5_script_support = ! is_admin() && ! current_theme_supports( 'html5', 'script' );
|
||||
$attributes_string = '';
|
||||
|
||||
// If HTML5 script tag is supported, only the attribute name is added
|
||||
// to $attributes_string for entries with a boolean value, and that are true.
|
||||
foreach ( $attributes as $attribute_name => $attribute_value ) {
|
||||
if ( is_bool( $attribute_value ) ) {
|
||||
if ( $attribute_value ) {
|
||||
$attributes_string .= $html5_script_support ? sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_name ) ) : ' ' . $attribute_name;
|
||||
}
|
||||
} else {
|
||||
$attributes_string .= sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_value ) );
|
||||
}
|
||||
}
|
||||
|
||||
return $attributes_string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Formats `<script>` loader tags.
|
||||
*
|
||||
* It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
|
||||
* Automatically injects type attribute if needed.
|
||||
*
|
||||
* @since 5.7.0
|
||||
*
|
||||
* @param array $attributes Key-value pairs representing `<script>` tag attributes.
|
||||
* @return string String containing `<script>` opening and closing tags.
|
||||
*/
|
||||
function wp_get_script_tag( $attributes ) {
|
||||
if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
|
||||
$attributes['type'] = 'text/javascript';
|
||||
}
|
||||
/**
|
||||
* Filters attributes to be added to a script tag.
|
||||
*
|
||||
* @since 5.7.0
|
||||
*
|
||||
* @param array $attributes Key-value pairs representing `<script>` tag attributes.
|
||||
* Only the attribute name is added to the `<script>` tag for
|
||||
* entries with a boolean value, and that are true.
|
||||
*/
|
||||
$attributes = apply_filters( 'wp_script_attributes', $attributes );
|
||||
|
||||
return sprintf( "<script%s></script>\n", wp_sanitize_script_attributes( $attributes ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Prints formatted `<script>` loader tag.
|
||||
*
|
||||
* It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
|
||||
* Automatically injects type attribute if needed.
|
||||
*
|
||||
* @since 5.7.0
|
||||
*
|
||||
* @param array $attributes Key-value pairs representing `<script>` tag attributes.
|
||||
*/
|
||||
function wp_print_script_tag( $attributes ) {
|
||||
echo wp_get_script_tag( $attributes );
|
||||
}
|
||||
|
||||
/**
|
||||
* Wraps inline JavaScript in `<script>` tag.
|
||||
*
|
||||
* It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
|
||||
* Automatically injects type attribute if needed.
|
||||
*
|
||||
* @since 5.7.0
|
||||
*
|
||||
* @param string $javascript Inline JavaScript code.
|
||||
* @param array $attributes Optional. Key-value pairs representing `<script>` tag attributes.
|
||||
* @return string String containing inline JavaScript code wrapped around `<script>` tag.
|
||||
*/
|
||||
function wp_get_inline_script_tag( $javascript, $attributes = array() ) {
|
||||
if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
|
||||
$attributes['type'] = 'text/javascript';
|
||||
}
|
||||
/**
|
||||
* Filters attributes to be added to a script tag.
|
||||
*
|
||||
* @since 5.7.0
|
||||
*
|
||||
* @param array $attributes Key-value pairs representing `<script>` tag attributes.
|
||||
* Only the attribute name is added to the `<script>` tag for
|
||||
* entries with a boolean value, and that are true.
|
||||
*/
|
||||
$attributes = apply_filters( 'wp_inline_script_attributes', $attributes, $javascript );
|
||||
|
||||
$javascript = "\n" . trim( $javascript, "\n\r " ) . "\n";
|
||||
|
||||
return sprintf( "<script%s>%s</script>\n", wp_sanitize_script_attributes( $attributes ), $javascript );
|
||||
}
|
||||
|
||||
/**
|
||||
* Prints inline JavaScript wrapped in `<script>` tag.
|
||||
*
|
||||
* It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
|
||||
* Automatically injects type attribute if needed.
|
||||
*
|
||||
* @since 5.7.0
|
||||
*
|
||||
* @param string $javascript Inline JavaScript code.
|
||||
* @param array $attributes Optional. Key-value pairs representing `<script>` tag attributes.
|
||||
*/
|
||||
function wp_print_inline_script_tag( $javascript, $attributes = array() ) {
|
||||
echo wp_get_inline_script_tag( $javascript, $attributes );
|
||||
}
|
||||
|
@ -13,7 +13,7 @@
|
||||
*
|
||||
* @global string $wp_version
|
||||
*/
|
||||
$wp_version = '5.7-alpha-50166';
|
||||
$wp_version = '5.7-alpha-50167';
|
||||
|
||||
/**
|
||||
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
|
||||
|
Loading…
Reference in New Issue
Block a user