Checks for valid namespace characters in data-wp-interactive

src/wp-includes/interactivity-api/class-wp-interactivity-api.php

@@ -495,16 +495,18 @@ private function data_wp_interactive_processor( WP_Interactivity_API_Directives_
 		 * independently of whether the previous `data-wp-interactive` definition
 		 * contained a valid namespace.
 		 */
+		$new_namespace = null;
 		if ( is_string( $attribute_value ) && ! empty( $attribute_value ) ) {
 			$decoded_json = json_decode( $attribute_value, true );
 			if ( is_array( $decoded_json ) ) {
-				$namespace_stack[] = $decoded_json['namespace'] ?? end( $namespace_stack );
+				$new_namespace = $decoded_json['namespace'] ?? null;
 			} else {
-				$namespace_stack[] = $attribute_value;
+				$new_namespace = $attribute_value;
 			}
-		} else {
-			$namespace_stack[] = end( $namespace_stack );
 		}
+		$namespace_stack[] = ( $new_namespace && 1 === preg_match( '/^([\w\-_\/]+)/', $new_namespace ) )
+			? $new_namespace
+			: end( $namespace_stack );
 	}
 
 	/**

tests/phpunit/tests/interactivity-api/wpInteractivityAPI-wp-interactive.php

@@ -147,6 +147,29 @@ public function test_wp_interactive_with_empty_value_doesnt_replace_the_previous
 		$this->assertEquals( 'some-id', $p->get_attribute( 'id' ) );
 	}
 
+	/**
+	 * Tests that an invalid value for `data-wp-interactive` does not replace the
+	 * previously established default namespace.
+	 *
+	 * @ticket 60356
+	 *
+	 * @covers ::process_directives
+	 */
+	public function test_wp_interactive_with_invalid_value_doesnt_replace_the_previous_default_namespace() {
+		$html    = '
+				<div data-wp-interactive=\'{ "namespace": "myPlugin" }\'>
+						<div data-wp-interactive="$myPlugin">
+								<div class="test" data-wp-bind--id="state.id">Text</div>
+						</div>
+						<div class="test" data-wp-bind--id="state.id">Text</div>
+				</div>
+		';
+		list($p) = $this->process_directives( $html );
+		$this->assertEquals( 'some-id', $p->get_attribute( 'id' ) );
+		$p->next_tag( array( 'class_name' => 'test' ) );
+		$this->assertEquals( 'some-id', $p->get_attribute( 'id' ) );
+	}
+
 	/**
 	 * Tests that a `data-wp-interactive` directive with no assigned value does
 	 * not replace the previously established default namespace.