Repository navigation
i18n: Escape decoded HTML attributes - #862
Merged
Merged
Conversation
mikachan
reviewed
Sep 25, 2026
mikachan
left a comment
mikachan
left a comment
Member
There was a problem hiding this comment.
It looks like this introduces a regression, as attribute names are no longer being escaped.
As the blanket pre-escape has been removed, that means values are now escaped individually but names aren't, in any of the four branches of process_attribute().
We should be able to fix this by adding this to the top of process_attribute() (which should fix all branches):
private function process_attribute( $attr_name, $attr_value ) {
$token_part = '';
$attr_name = $this->escape_php_single_quoted_string( $attr_name );
| * @param string $value The value to escape. | ||
| * @return string The escaped value. | ||
| */ | ||
| private function escape_php_single_quoted_string( $value ) { |
Member
There was a problem hiding this comment.
This function is now duplicated in here and theme-locale.php. Is it worth extracting this to a single shared function?
Escape tag names and attribute names before they are embedded in generated PHP strings, since the blanket pre-escape no longer covers them. Move escape_php_single_quoted_string() to CBT_Theme_Utils so the locale and token processor classes share one implementation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 tasks done
Contributor
Author
|
CIs are red, but a fix for that is in #877 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Escape HTML attribute values after token processing during localized export.
This preserves encoded quotes and backslashes after the HTML processor decodes attribute values.
Test plan
vendor/bin/phpunit -c phpunit.xml.dist --verbose --group localevendor/bin/phpunit -c phpunit.xml.dist --verbose --filter 'CBT_Theme_Locale_EscapeTextContent|test_token_processor'vendor/bin/phpcs --standard=phpcs.xml.dist includes/create-theme/theme-locale.php includes/create-theme/theme-token-processor.php tests/CbtThemeLocale/escapeTextContent.php