WP_HTML_Tag_Processor::parse_query( array|string|null $query )

Source

		case 'module':
			return 'javascript';

		/*
		 * > Otherwise, if the script block's type string is an ASCII case-insensitive match for the string "importmap", then set el's type to "importmap".
		 * > Otherwise, if the script block's type string is an ASCII case-insensitive match for the string "speculationrules", then set el's type to "speculationrules".
		 *
		 * These conditions indicate JSON content.
		 */
		case 'importmap':
		case 'speculationrules':
			return 'json';

		/** @todo Rely on a full MIME parser for determining JSON content. */
		case 'application/json':
		case 'text/json':
			return 'json';
	}

	/*
	 * > Otherwise, return. (No script is executed, and el's type is left as null.)
	 */
	return null;
}

/**
 * Escape JavaScript and JSON script tag contents.
 *
 * Ensure that the script contents cannot modify the HTML structure or break out
 * of its containing SCRIPT element. JavaScript and JSON may both be escaped with
 * the same rules, even though there are additional escaping measures available
 * to JavaScript source code which aren’t applicable to serialized JSON data.
 *
 * A simple method safely escapes all content except for a few extremely rare and
 * unlikely exceptions: prevent the appearance of `<script` and `</script` within
 * the contents by replacing the first letter of the tag name with a Unicode escape.
 *
 * Example:
 *
 *     $plaintext = '<script>document.write( "A </script> closes a script." );</script>';
 *     $escaped   = '<script>document.write( "A </\u0073cript> closes a script." );</script>';
 *
 * This works because of how parsing changes after encountering an opening SCRIPT
 * tag. The actual parsing comprises a complicated state machine, the result of
 * legacy behaviors and diverse browser support. However, without these two strings
 * in the script contents, two key things are ensured: `</script>` cannot appear to
 * prematurely close the tag, and the problematic double-escaped state becomes
 * unreachable. A JavaScript engine or JSON decoder will then decode the Unicode

View all references View on Trac View on GitHub