Skip to content

Improve Interactivity API store JSON encoding #6520

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sirreal wants to merge 12 commits into from
Closed

Improve Interactivity API store JSON encoding #6520

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
a99ec25
Improve Interactivity API store JSON encoding
sirreal May 7, 2024
8a6d30f
Only set unescaped unicode with UTF-8
sirreal May 8, 2024
312d6ea
Remove JSON_HEX_AMP
sirreal May 9, 2024
3e30117
Add JSON_UNESCAPED_LINE_TERMINATORS
sirreal May 9, 2024
cf29aa6
Add comments
sirreal May 9, 2024
76c7a5e
Smaller config in test
sirreal May 9, 2024
f2b07eb
Fix heredoc end
sirreal May 9, 2024
5c2d273
Remove bad function arg trailing comma
sirreal May 9, 2024
b9cd850
Add more details to comments
sirreal May 9, 2024
8a7e4e0
Remove redundant tear_down method.
sirreal May 10, 2024
67bd236
Merge branch 'trunk' into add/iapi-better-json-encoding
dmsnell May 15, 2024
7ecc709
Rearrange comment and set UTF-8 as the normative encoding.
dmsnell May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix heredoc end
  • Loading branch information
@sirreal
sirreal committed May 9, 2024
commit f2b07eb648952f6ca7dbf127a12296cbd1401211
16 changes: 6 additions & 10 deletions tests/phpunit/tests/interactivity-api/wpInteractivityAPI.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -386,12 +386,10 @@ public function test_state_and_config_escape_special_characters() {
$interactivity_data_markup = get_echo( array( $this->interactivity, 'print_client_interactivity_data' ) );
preg_match( '~<script type="application/json" id="wp-interactivity-data">\s*(\{.*\})\s*</script>~s', $interactivity_data_markup, $interactivity_data_string );

$this->assertEquals(
<<<"JSON"
$expected = <<<"JSON"
{"config":{"myPlugin":{"chars":"&\\u003C\\u003E/"}},"state":{"myPlugin":{"ampersand":"&","less-than sign":"\\u003C","greater-than sign":"\\u003E","solidus":"/","line separator":"\u{2028}","paragraph separator":"\u{2029}","flag of england":"\u{1F3F4}\u{E0067}\u{E0062}\u{E0065}\u{E006E}\u{E0067}\u{E007F}","malicious script closer":"\\u003C/script\\u003E","entity-encoded malicious script closer":"&lt;/script&gt;"}}}
JSON,
$interactivity_data_string[1]
);
JSON;
$this->assertEquals( $expected, $interactivity_data_string[1] );
}

/**
Expand Down Expand Up @@ -428,12 +426,10 @@ public function test_state_and_config_escape_special_characters_non_utf8() {
$interactivity_data_markup = get_echo( array( $this->interactivity, 'print_client_interactivity_data' ) );
preg_match( '~<script type="application/json" id="wp-interactivity-data">\s*(\{.*\})\s*</script>~s', $interactivity_data_markup, $interactivity_data_string );

$this->assertEquals(
<<<"JSON"
$expected = <<<"JSON"
{"config":{"myPlugin":{"chars":"&\\u003C\\u003E/"}},"state":{"myPlugin":{"ampersand":"&","less-than sign":"\\u003C","greater-than sign":"\\u003E","solidus":"/","line separator":"\\u2028","paragraph separator":"\\u2029","flag of england":"\\ud83c\\udff4\\udb40\\udc67\\udb40\\udc62\\udb40\\udc65\\udb40\\udc6e\\udb40\\udc67\\udb40\\udc7f","malicious script closer":"\\u003C/script\\u003E","entity-encoded malicious script closer":"&lt;/script&gt;"}}}
JSON,
$interactivity_data_string[1]
);
JSON;
$this->assertEquals( $expected, $interactivity_data_string[1] );
Copy link
Member

@westonruter westonruter May 9, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Idea: This could use the HTML Processor to step over the tokens in $interactivity_data_markup as an additional check to ensure that the malicious script closer does not prematurely close the script. Maybe use the PHP's DOM API as well?

Copy link
Member Author

@sirreal sirreal May 10, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought the same thing as I worked with these tests. However, in this case I think it makes sense to match and work with literal strings. I don't have much confidence in any of the parsers to do what I expect and not try to interpret any of this as HTML markup. I want to know exactly what characters are output and don't want any entities to be transformed.

Copy link
Member Author

@sirreal sirreal May 10, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The HTML Processor doesn't support SCRIPT tags right now, and the tag processor is much more rudimentary. I'm not sure either is ready to handle what you suggest. @dmsnell thoughts on this?

Copy link
Member

@dmsnell dmsnell May 10, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in this case the Tag Processor should be inscrutable for testing SCRIPT elements, because it does consume the entire thing in one go. you can compare get_modifiable_text() to your expectation to see what was inside the script

}

/**
Expand Down