HTML API: Escape syntax characters in RCDATA

[dmsnell]

Trac ticket: Core-65984

Status

• Add some tests to demonstrate behavior.

Description

Characters in TITLE and TEXTAREA aren’t required to be escaped, but doing so might prevent downstream parsers from mis-parsing content inside of these elements as markup, when in fact they are plaintext.

This patch escapes the content by default to prevent such a scenario.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[sirreal]

This is probably an improvement overall for anything inspecting HTML downstream.

Assume HTML like: <title><foo>&lt;bar&gt;</title>

There are two obvious ways to mis-parse this:

• <foo> treated as a start tag (it's the text <foo>)
• <bar> not decoded (it's the text <bar>).

This change would eliminate the first category <foo>, while leaving the second category <bar> exactly the same. The tradeoff here is that naive parsers are more likely to confuse the text <foo> for an element, and if they don't correctly handle decoding… well that would already be broken.

I'm in favor of this, it's perfectly valid and correct HTML and simplifies the surface area of HTML trivia that needs to be correctly implemented downstream.

---

In some related CSS work, I made a similar decision. It's best to remove possibly confusing syntax characters entirely where escaping is possible.

[dmsnell]

I’ve added the comments, updated the code, and added tests verifying the behavior.

Assuming those pass I will merge this!

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props dmsnell, westonruter, jonsurrell.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[dmsnell]

Merged in [63418]
049287a