HTML API: Replace null-bytes in class_list class names

As part of an audit of HTML API CSS behaviors, this patch resolves an issue with how the HTML API reports class names containing the NULL byte. NULL bytes should be replaced by the Unicode replacement character, U+FFFD, but previously weren't. This patch performs that replacement.

Developed in https://github.com/WordPress/wordpress-develop/pull/7187
Discussed in https://core.trac.wordpress.org/ticket/61531

Follow-up to [56703].

Props dmsnell, jonsurrell.
See #61531.

Built from https://develop.svn.wordpress.org/trunk@58969


git-svn-id: http://core.svn.wordpress.org/trunk@58365 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-includes/html-api/class-wp-html-tag-processor.php

@@ -1160,7 +1160,7 @@ class WP_HTML_Tag_Processor {
 			 *
 			 * @see https://www.w3.org/TR/CSS2/syndata.html#x1
 			 */
-			$name = strtolower( substr( $class, $at, $length ) );
+			$name = str_replace( "\x00", "\u{FFFD}", strtolower( substr( $class, $at, $length ) ) );
 			$at  += $length;
 
 			/*

wp-includes/version.php

@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.7-alpha-58968';
+$wp_version = '6.7-alpha-58969';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.