HTML API: Prevent WP_HTML_Tag_Processor instances being unserialized and add some extra logic for validating pattern and template file paths.

Merges [61880,61881] to the 6.9 branch.
Props dmsnell, xknown, jonsurrell, peterwilsoncc, johnbillion.



git-svn-id: https://develop.svn.wordpress.org/branches/6.9@61892 602fd350-edb4-49c9-b593-d223f7449a82

Author: audrasjb

src/wp-includes/class-wp-block-patterns-registry.php

@@ -173,12 +173,21 @@ private function get_content( $pattern_name, $outside_init_only = false ) {
 		} else {
 			$patterns = &$this->registered_patterns;
 		}
-		if ( ! isset( $patterns[ $pattern_name ]['content'] ) && isset( $patterns[ $pattern_name ]['filePath'] ) ) {
+
+		$pattern_path = realpath( $patterns[ $pattern_name ]['filePath'] ?? '' );
+		if (
+			! isset( $patterns[ $pattern_name ]['content'] ) &&
+			is_string( $pattern_path ) &&
+			( str_ends_with( $pattern_path, '.php' ) || str_ends_with( $pattern_path, '.html' ) ) &&
+			is_file( $pattern_path ) &&
+			is_readable( $pattern_path )
+		) {
 			ob_start();
 			include $patterns[ $pattern_name ]['filePath'];
 			$patterns[ $pattern_name ]['content'] = ob_get_clean();
 			unset( $patterns[ $pattern_name ]['filePath'] );
 		}
+
 		return $patterns[ $pattern_name ]['content'];
 	}
 

src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -4680,4 +4680,13 @@ public function get_doctype_info(): ?WP_HTML_Doctype_Info {
 	 * @since 6.7.0
 	 */
 	const TEXT_IS_WHITESPACE = 'TEXT_IS_WHITESPACE';
+
+	/**
+	 * Wakeup magic method.
+	 *
+	 * @since 6.9.2
+	 */
+	public function __wakeup() {
+		throw new \LogicException( __CLASS__ . ' should never be unserialized' );
+	}
 }

src/wp-includes/template-loader.php

@@ -112,7 +112,13 @@
 	 * @param string $template The path of the template to include.
 	 */
 	$template = apply_filters( 'template_include', $template );
-	if ( $template ) {
+	$template = is_string( $template ) ? realpath( $template ) : null;
+	if (
+		is_string( $template ) &&
+		( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&
+		is_file( $template ) &&
+		is_readable( $template )
+	) {
 		/**
 		 * Fires immediately before including the template.
 		 *