Get WordPress

Make WordPress Core

Opened 2 years ago

Closed 2 years ago

#55506 closed defect (bug) (fixed)

HTML tags not escaped

Reported by: gvgvgvijayan's profile gvgvgvijayan Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 6.0 Priority: normal
Severity: normal Version: 5.9
Component: REST API Keywords: has-patch needs-testing
Focuses: docs Cc:

Description

​https://developer.wordpress.org/reference/since/5.9.0/page/3/

​https://imgur.com/a/Gebwf2z

Attachments (4)

html-broken.png​ (314.2 KB) - added by gvgvgvijayan 2 years ago.
55506.v2022032338.patch​ (521 bytes) - added by rsiddharth 2 years ago.
55506.patch​ (3.7 KB) - added by johnbillion 2 years ago.
55506.2.patch​ (3.2 KB) - added by mukesh27 2 years ago.
Fix for <head> tag

Download all attachments as: .zip

Change History (16)

@gvgvgvijayan
2 years ago

#1 @azouamauriac
2 years ago

  • Keywords 2nd-opinion added

Hi there, welcome to core trac; thanks for the report;

Seems like the right place to report this kind of issue is ​here.
RE: ​https://prnt.sc/VTo81CkFK-nu

#2 @SergeyBiryukov
2 years ago

  • Component changed from WordPress.org Site to REST API
  • Keywords needs-patch good-first-bug added; 2nd-opinion removed
  • Milestone changed from Awaiting Review to 6.0

Hi there, welcome back to WordPress Trac! Thanks for the ticket.

As noted above, any issues with the documentation parser should indeed be reported on ​Meta Trac.

However, per the ​WordPress documentation standards, function summaries should not use any markup:

No HTML markup or Markdown of any kind should be used in the summary. If the text refers to an HTML element or tag, then it should be written as “image tag” or “img” element, not “<img>”. For example:

  • Good: Fires when printing the link tag in the header.
  • Bad: Fires when printing the <link> tag in the header.

So I think the WP_REST_URL_Details_Controller::get_title() description:

Parses the <title> contents from the provided HTML.

should be changed to this:

Parses the title tag contents from the provided HTML.

Last edited 2 years ago by SergeyBiryukov (previous) (diff)

@rsiddharth
2 years ago

#3 @rsiddharth
2 years ago

  • Keywords has-patch added; needs-patch removed

#4 @azouamauriac
2 years ago

  • Keywords needs-patch added; has-patch removed

Hello @rsiddharth thanks for the patch it looks good for me, but as you are at it, would you mind to fix some related typos in the same file? here they are :

  • WP_REST_URL_Details_Controller::get_document_head;
  • WP_REST_URL_Details_Controller::get_meta_with_content_elements,
  • WP_REST_URL_Details_Controller::parse_url_details,

The summary of the above functions contain html tag, can you fix them please?

#5 @gvgvgvijayan
2 years ago

Thanks all.
Got it, next time will post at ​https://meta.trac.wordpress.org/newticket

#6 @SergeyBiryukov
2 years ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 53048:

Docs: Remove HTML markup from WP_REST_URL_Details_Controller class method summaries.

Per the ​WordPress PHP documentation standards, no HTML markup or Markdown of any kind should be used in the summary. This ensures that the summary is displayed correctly in the ​WordPress Code Reference.

Props gvgvgvijayan, rsiddharth, azouamauriac, SergeyBiryukov.
Fixes #55506.

#7 @johnbillion
2 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

Found a few more.

@johnbillion
2 years ago

#8 @johnbillion
2 years ago

  • Keywords has-patch needs-testing added; good-first-bug needs-patch removed

55506.patch​ fixes some more instances of HTML tags and also improves the formatting of HTML special characters in descriptions.

#9 @azouamauriac
2 years ago

  • Keywords close added

Hi @johnbillion thanks for the patch, but I think the best place to report it is here #54729

#10 @SergeyBiryukov
2 years ago

  • Keywords close removed

#54729 is a general ticket for any issues that don't have their own ticket. For more specific changes like this, I think it's fine to make any follow-up fixes on the same ticket, so that the context is clear.

Last edited 2 years ago by SergeyBiryukov (previous) (diff)

@mukesh27
2 years ago

Fix for <head> tag

#11 @SergeyBiryukov
2 years ago

Thanks for the additional fixes!

Looking at 55506.2.patch​, I think most of these instances are fine, as the documentation standards, when mentioning HTML markup, specifically refer to function summaries and not other DocBlock parts or inline comments. As seen in the ​wp_enqueue_script() function reference, the description for the $in_footer parameter is displayed correctly as is.

#12 @SergeyBiryukov
2 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 53053:

Docs: Further remove HTML markup from various function summaries.

Per the ​WordPress PHP documentation standards, no HTML markup or Markdown of any kind should be used in the summary. This ensures that the summary is displayed correctly in the ​WordPress Code Reference.

This commit also improves formatting of HTML special characters in descriptions in wp-includes/formatting.php.

Follow-up to [53048].

Props johnbillion, mukesh27.
Fixes #55506.

Note: See TracTickets for help on using tickets.