From c463e94a3313ca26c305993a0862e758c0ea3dfe Mon Sep 17 00:00:00 2001
From: Peter Wilson <wilson@peterwilson.cc>
Date: Tue, 23 Feb 2021 02:00:06 +0000
Subject: [PATCH] Security: move Content-Security-Policy script loaders.
Move `wp_get_script_tag()`, `wp_print_script_tag()`, `wp_print_inline_script_tag()` and `wp_get_inline_script_tag()` functions from `functions.php` to `script-loader.php`.
Relocate related tests to `dependencies` sub-directory.
Follow up to [50167].
Props adamsilverstein, hellofromTonya, SergeyBiryukov.
Fixes #39941.
Built from https://develop.svn.wordpress.org/trunk@50409
git-svn-id: http://core.svn.wordpress.org/trunk@50020 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
wp-includes/functions.php | 120 ----------------------------------
wp-includes/script-loader.php | 120 ++++++++++++++++++++++++++++++++++
wp-includes/version.php | 2 +-
3 files changed, 121 insertions(+), 121 deletions(-)
diff --git a/wp-includes/functions.php b/wp-includes/functions.php
index 56f50ce2de..5935f781fb 100644
--- a/wp-includes/functions.php
+++ b/wp-includes/functions.php
@@ -7866,123 +7866,3 @@ function is_php_version_compatible( $required ) {
function wp_fuzzy_number_match( $expected, $actual, $precision = 1 ) {
return abs( (float) $expected - (float) $actual ) <= $precision;
}
-
-/**
- * Sanitizes an attributes array into an attributes string to be placed inside a `<script>` tag.
- *
- * Automatically injects type attribute if needed.
- * Used by {@see wp_get_script_tag()} and {@see wp_get_inline_script_tag()}.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- * @return string String made of sanitized `<script>` tag attributes.
- */
-function wp_sanitize_script_attributes( $attributes ) {
- $html5_script_support = ! is_admin() && ! current_theme_supports( 'html5', 'script' );
- $attributes_string = '';
-
- // If HTML5 script tag is supported, only the attribute name is added
- // to $attributes_string for entries with a boolean value, and that are true.
- foreach ( $attributes as $attribute_name => $attribute_value ) {
- if ( is_bool( $attribute_value ) ) {
- if ( $attribute_value ) {
- $attributes_string .= $html5_script_support ? sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_name ) ) : ' ' . $attribute_name;
- }
- } else {
- $attributes_string .= sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_value ) );
- }
- }
-
- return $attributes_string;
-}
-
-/**
- * Formats `<script>` loader tags.
- *
- * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- * @return string String containing `<script>` opening and closing tags.
- */
-function wp_get_script_tag( $attributes ) {
- if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
- $attributes['type'] = 'text/javascript';
- }
- /**
- * Filters attributes to be added to a script tag.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- * Only the attribute name is added to the `<script>` tag for
- * entries with a boolean value, and that are true.
- */
- $attributes = apply_filters( 'wp_script_attributes', $attributes );
-
- return sprintf( "<script%s></script>\n", wp_sanitize_script_attributes( $attributes ) );
-}
-
-/**
- * Prints formatted `<script>` loader tag.
- *
- * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- */
-function wp_print_script_tag( $attributes ) {
- echo wp_get_script_tag( $attributes );
-}
-
-/**
- * Wraps inline JavaScript in `<script>` tag.
- *
- * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param string $javascript Inline JavaScript code.
- * @param array $attributes Optional. Key-value pairs representing `<script>` tag attributes.
- * @return string String containing inline JavaScript code wrapped around `<script>` tag.
- */
-function wp_get_inline_script_tag( $javascript, $attributes = array() ) {
- if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
- $attributes['type'] = 'text/javascript';
- }
- /**
- * Filters attributes to be added to a script tag.
- *
- * @since 5.7.0
- *
- * @param array $attributes Key-value pairs representing `<script>` tag attributes.
- * Only the attribute name is added to the `<script>` tag for
- * entries with a boolean value, and that are true.
- */
- $attributes = apply_filters( 'wp_inline_script_attributes', $attributes, $javascript );
-
- $javascript = "\n" . trim( $javascript, "\n\r " ) . "\n";
-
- return sprintf( "<script%s>%s</script>\n", wp_sanitize_script_attributes( $attributes ), $javascript );
-}
-
-/**
- * Prints inline JavaScript wrapped in `<script>` tag.
- *
- * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
- * Automatically injects type attribute if needed.
- *
- * @since 5.7.0
- *
- * @param string $javascript Inline JavaScript code.
- * @param array $attributes Optional. Key-value pairs representing `<script>` tag attributes.
- */
-function wp_print_inline_script_tag( $javascript, $attributes = array() ) {
- echo wp_get_inline_script_tag( $javascript, $attributes );
-}
diff --git a/wp-includes/script-loader.php b/wp-includes/script-loader.php
index 5df55e831d..c47a54429c 100644
--- a/wp-includes/script-loader.php
+++ b/wp-includes/script-loader.php
@@ -2332,3 +2332,123 @@ function wp_enqueue_editor_block_directory_assets() {
wp_enqueue_script( 'wp-block-directory' );
wp_enqueue_style( 'wp-block-directory' );
}
+
+/**
+ * Sanitizes an attributes array into an attributes string to be placed inside a `<script>` tag.
+ *
+ * Automatically injects type attribute if needed.
+ * Used by {@see wp_get_script_tag()} and {@see wp_get_inline_script_tag()}.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ * @return string String made of sanitized `<script>` tag attributes.
+ */
+function wp_sanitize_script_attributes( $attributes ) {
+ $html5_script_support = ! is_admin() && ! current_theme_supports( 'html5', 'script' );
+ $attributes_string = '';
+
+ // If HTML5 script tag is supported, only the attribute name is added
+ // to $attributes_string for entries with a boolean value, and that are true.
+ foreach ( $attributes as $attribute_name => $attribute_value ) {
+ if ( is_bool( $attribute_value ) ) {
+ if ( $attribute_value ) {
+ $attributes_string .= $html5_script_support ? sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_name ) ) : ' ' . $attribute_name;
+ }
+ } else {
+ $attributes_string .= sprintf( ' %1$s="%2$s"', esc_attr( $attribute_name ), esc_attr( $attribute_value ) );
+ }
+ }
+
+ return $attributes_string;
+}
+
+/**
+ * Formats `<script>` loader tags.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ * @return string String containing `<script>` opening and closing tags.
+ */
+function wp_get_script_tag( $attributes ) {
+ if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
+ $attributes['type'] = 'text/javascript';
+ }
+ /**
+ * Filters attributes to be added to a script tag.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ * Only the attribute name is added to the `<script>` tag for
+ * entries with a boolean value, and that are true.
+ */
+ $attributes = apply_filters( 'wp_script_attributes', $attributes );
+
+ return sprintf( "<script%s></script>\n", wp_sanitize_script_attributes( $attributes ) );
+}
+
+/**
+ * Prints formatted `<script>` loader tag.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ */
+function wp_print_script_tag( $attributes ) {
+ echo wp_get_script_tag( $attributes );
+}
+
+/**
+ * Wraps inline JavaScript in `<script>` tag.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param string $javascript Inline JavaScript code.
+ * @param array $attributes Optional. Key-value pairs representing `<script>` tag attributes.
+ * @return string String containing inline JavaScript code wrapped around `<script>` tag.
+ */
+function wp_get_inline_script_tag( $javascript, $attributes = array() ) {
+ if ( ! isset( $attributes['type'] ) && ! is_admin() && ! current_theme_supports( 'html5', 'script' ) ) {
+ $attributes['type'] = 'text/javascript';
+ }
+ /**
+ * Filters attributes to be added to a script tag.
+ *
+ * @since 5.7.0
+ *
+ * @param array $attributes Key-value pairs representing `<script>` tag attributes.
+ * Only the attribute name is added to the `<script>` tag for
+ * entries with a boolean value, and that are true.
+ */
+ $attributes = apply_filters( 'wp_inline_script_attributes', $attributes, $javascript );
+
+ $javascript = "\n" . trim( $javascript, "\n\r " ) . "\n";
+
+ return sprintf( "<script%s>%s</script>\n", wp_sanitize_script_attributes( $attributes ), $javascript );
+}
+
+/**
+ * Prints inline JavaScript wrapped in `<script>` tag.
+ *
+ * It is possible to inject attributes in the `<script>` tag via the {@see 'wp_script_attributes'} filter.
+ * Automatically injects type attribute if needed.
+ *
+ * @since 5.7.0
+ *
+ * @param string $javascript Inline JavaScript code.
+ * @param array $attributes Optional. Key-value pairs representing `<script>` tag attributes.
+ */
+function wp_print_inline_script_tag( $javascript, $attributes = array() ) {
+ echo wp_get_inline_script_tag( $javascript, $attributes );
+}
diff --git a/wp-includes/version.php b/wp-includes/version.php
index e579cecae4..fab197f3a4 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
-$wp_version = '5.7-beta3-50408';
+$wp_version = '5.7-beta3-50409';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.