From 31465cc5747c5323ab4fcddad19c2bc19859c18f Mon Sep 17 00:00:00 2001
From: audrasjb <audrasjb@git.wordpress.org>
Date: Mon, 24 Jun 2024 14:42:09 +0000
Subject: [PATCH] Editor: Sanitize Template Part HTML tag on save.

Props xknown, peterwilsoncc, jorbin, bernhard-reiter, azaozz.



Built from https://develop.svn.wordpress.org/trunk@58471


git-svn-id: http://core.svn.wordpress.org/trunk@57920 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/blocks.php     | 36 ++++++++++++++++++++++++++++++++----
 wp-includes/formatting.php |  3 ++-
 wp-includes/version.php    |  2 +-
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/wp-includes/blocks.php b/wp-includes/blocks.php
index decc4896c3..5ef250a863 100644
--- a/wp-includes/blocks.php
+++ b/wp-includes/blocks.php
@@ -1725,7 +1725,7 @@ function _filter_block_content_callback( $matches ) {
  * @return array The filtered and sanitized block object result.
  */
 function filter_block_kses( $block, $allowed_html, $allowed_protocols = array() ) {
-	$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols );
+	$block['attrs'] = filter_block_kses_value( $block['attrs'], $allowed_html, $allowed_protocols, $block );
 
 	if ( is_array( $block['innerBlocks'] ) ) {
 		foreach ( $block['innerBlocks'] as $i => $inner_block ) {
@@ -1741,6 +1741,7 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
  * non-allowable HTML.
  *
  * @since 5.3.1
+ * @since 6.5.5 Added the `$block_context` parameter.
  *
  * @param string[]|string $value             The attribute value to filter.
  * @param array[]|string  $allowed_html      An array of allowed HTML elements and attributes,
@@ -1748,14 +1749,18 @@ function filter_block_kses( $block, $allowed_html, $allowed_protocols = array()
  *                                           for the list of accepted context names.
  * @param string[]        $allowed_protocols Optional. Array of allowed URL protocols.
  *                                           Defaults to the result of wp_allowed_protocols().
+ * @param array           $block_context     Optional. The block the attribute belongs to, in parsed block array format.
  * @return string[]|string The filtered and sanitized result.
  */
-function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array() ) {
+function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = array(), $block_context = null ) {
 	if ( is_array( $value ) ) {
 		foreach ( $value as $key => $inner_value ) {
-			$filtered_key   = filter_block_kses_value( $key, $allowed_html, $allowed_protocols );
-			$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols );
+			$filtered_key   = filter_block_kses_value( $key, $allowed_html, $allowed_protocols, $block_context );
+			$filtered_value = filter_block_kses_value( $inner_value, $allowed_html, $allowed_protocols, $block_context );
 
+			if ( isset( $block_context['blockName'] ) && 'core/template-part' === $block_context['blockName'] ) {
+				$filtered_value = filter_block_core_template_part_attributes( $filtered_value, $filtered_key, $allowed_html );
+			}
 			if ( $filtered_key !== $key ) {
 				unset( $value[ $key ] );
 			}
@@ -1769,6 +1774,29 @@ function filter_block_kses_value( $value, $allowed_html, $allowed_protocols = ar
 	return $value;
 }
 
+
+/**
+ * Sanitizes the value of the Template Part block's `tagName` attribute.
+ *
+ * @since 6.5.5
+ *
+ * @param string          $attribute_value   The attribute value to filter.
+ * @param string          $attribute_name    The attribute name.
+ * @param array[]|string  $allowed_html      An array of allowed HTML elements and attributes,
+ *                                           or a context name such as 'post'. See wp_kses_allowed_html()
+ *                                           for the list of accepted context names.
+ * @return string The sanitized attribute value.
+ */
+function filter_block_core_template_part_attributes( $attribute_value, $attribute_name, $allowed_html ) {
+	if ( empty( $attribute_value ) || 'tagName' !== $attribute_name ) {
+		return $attribute_value;
+	}
+	if ( ! is_array( $allowed_html ) ) {
+		$allowed_html = wp_kses_allowed_html( $allowed_html );
+	}
+	return isset( $allowed_html[ $attribute_value ] ) ? $attribute_value : '';
+}
+
 /**
  * Parses blocks out of a content string, and renders those appropriate for the excerpt.
  *
diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php
index 2068e5f3a7..85ca245212 100644
--- a/wp-includes/formatting.php
+++ b/wp-includes/formatting.php
@@ -4790,12 +4790,13 @@ EOF;
  * Escapes an HTML tag name.
  *
  * @since 2.5.0
+ * @since 6.5.5 Allow hyphens in tag names (i.e. custom elements).
  *
  * @param string $tag_name
  * @return string
  */
 function tag_escape( $tag_name ) {
-	$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9_:]/', '', $tag_name ) );
+	$safe_tag = strtolower( preg_replace( '/[^a-zA-Z0-9-_:]/', '', $tag_name ) );
 	/**
 	 * Filters a string cleaned and escaped for output as an HTML tag.
 	 *
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 69368e9503..4d58f5da4f 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.6-beta3-58470';
+$wp_version = '6.6-beta3-58471';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.