RAWTEXT and SCRIPT elements do no decode character references

dmsnell · dmsnell · commit 3d8b20e50a63 · 2024-01-16T09:58:13.000-06:00
diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -2703,6 +2703,7 @@ public function get_modifiable_text() {
 
 		$text = substr( $this->html, $this->text_starts_at, $this->text_length );
 
+		// Comment data is not decoded.
 		if (
 			self::STATE_CDATA_NODE === $this->parser_state ||
 			self::STATE_COMMENT === $this->parser_state ||
@@ -2713,6 +2714,21 @@ public function get_modifiable_text() {
 			return $text;
 		}
 
+		$tag_name = $this->get_tag();
+		if (
+			// Script data is not decoded.
+			'SCRIPT' === $tag_name ||
+
+			// RAWTEXT data is not decoded.
+			'IFRAME' === $tag_name ||
+			'NOEMBED' === $tag_name ||
+			'NOFRAMES' === $tag_name ||
+			'STYLE' === $tag_name ||
+			'XMP' === $tag_name
+		) {
+			return $text;
+		}
+
 		$decoded = html_entity_decode( $text, ENT_QUOTES | ENT_HTML5 | ENT_SUBSTITUTE );
 
 		if ( empty( $decoded ) ) {
@@ -2726,7 +2742,7 @@ public function get_modifiable_text() {
 		 * for a leading newline and removing it.
 		 */
 		if ( self::STATE_MATCHED_TAG === $this->parser_state ) {
-			switch ( $this->get_tag() ) {
+			switch ( $tag_name ) {
 				case 'PRE':
 				case 'TEXTAREA':
 					if ( "\n" === $decoded[0] ) {
diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessor-token-scanning.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessor-token-scanning.php
@@ -284,7 +284,7 @@ public function test_basic_assertion_rawtext_elements( $tag_name ) {
 		);
 
 		$this->assertSame(
-			"\nIs <HTML> > XHTML?\n",
+			"\nIs <HTML> &gt; XHTML?\n",
 			$processor->get_modifiable_text(),
 			'Found incorrect modifiable text.'
 		);
@@ -378,6 +378,12 @@ public function test_basic_assertion_abruptly_closed_cdata_section() {
 
 		$processor->next_token();
 
+		$this->assertSame(
+			'#text',
+			$processor->get_token_name(),
+			"Should have found text node but found {$processor->get_token_name()} instead."
+		);
+
 		$this->assertSame(
 			' a comment]]>',
 			$processor->get_modifiable_text(),
