How should dynamic blocks handle escaping inner blocks? #37823
Replies: 3 comments
-
|
I am also facing the same problem in Gutenberg development. Is there any solution to escape the $content attribute? $content always gets caught by the WordPress Plugin Check plugin? |
Beta Was this translation helpful? Give feedback.
-
|
I see this is an old discussion, but did you ever form an opinion on this @fabiankaegy? 🙂 I have been wondering the same thing recently, for the exact same reasons you listed - embed blocks as inner blocks of a custom block. I'm forming the opinion that parent blocks shouldn't be responsible for escaping the output of their inner blocks. As far as I can tell, block content is deemed 'trusted' within core, and I suppose blocks should be responsible for escaping their own attributes, etc. Then, we're reliant on the This doesn't quite sit right with me, but I'd also like to avoid using custom |
Beta Was this translation helpful? Give feedback.
-
I agree with this. I'm curious why blocks have to handle escaping for their inner blocks. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
When a block is using dynamic rendering (defines a
render_callbackin PHP) and has inner blocks, it gets the html content of these inner blocks passed in via the second parameter of therender_callbackfunction.The question is how this
$contentparameter should be escaped. Looking at the WordPress VIP Coding Standards for example it states: https://docs.wpvip.com/technical-references/security/validating-sanitizing-and-escaping/#h-always-escape-lateBut when you run
wp_kses_post( $content )that breaks functionality like the core embed block. Some filters like the oembed system in WordPress get applied to the block before it gets passed into a parent block.We've also tried to apply the
the_contentfilters on the block content to get the oembed to work again but that has no success.Looking at the actual source code of this does not really answer the question which filters get applied either: https://github.com/WordPress/wordpress-develop/blob/ef404e2599b7e9ff0a9568d0f7348731e89f5f14/src/wp-includes/class-wp-block.php#L205-L304
Looking at some of the core blocks the
$contentstring is not escaped and just output as is from the parent blocks. This always gets flagged in VIP Code Reviews for example and there isn't any clear guidance on what the best practice here should be.Thanks in advance for any thoughts on this :)
Beta Was this translation helpful? Give feedback.
All reactions