Skip to content

Commit 639719a

Browse files
committed
Move script data length checks to top of loop
1 parent 8938a32 commit 639719a

File tree

1 file changed

+9
-7
lines changed

1 file changed

+9
-7
lines changed

src/wp-includes/html-api/class-wp-html-tag-processor.php

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1495,14 +1495,22 @@ private function skip_script_data(): bool {
14951495

14961496
while ( false !== $at && $at < $doc_length ) {
14971497
$at += strcspn( $html, '-<', $at );
1498+
/*
1499+
* Ultimately a SCRIPT closer (`</script>`) must be found or this function will
1500+
* return false.
1501+
* `</script` is the longest sequence that can be matched, so subsequent length checks
1502+
* are redundant.
1503+
*/
1504+
if ( $at + 8 >= $doc_length ) {
1505+
return false;
1506+
}
14981507

14991508
/*
15001509
* For all script states a "-->" transitions
15011510
* back into the normal unescaped script mode,
15021511
* even if that's the current state.
15031512
*/
15041513
if (
1505-
$at + 2 < $doc_length &&
15061514
'-' === $html[ $at ] &&
15071515
'-' === $html[ $at + 1 ] &&
15081516
'>' === $html[ $at + 2 ]
@@ -1512,10 +1520,6 @@ private function skip_script_data(): bool {
15121520
continue;
15131521
}
15141522

1515-
if ( $at + 1 >= $doc_length ) {
1516-
return false;
1517-
}
1518-
15191523
/*
15201524
* Everything of interest past here starts with "<".
15211525
* Check this character and advance position regardless.
@@ -1537,7 +1541,6 @@ private function skip_script_data(): bool {
15371541
* parsing after updating the state.
15381542
*/
15391543
if (
1540-
$at + 2 < $doc_length &&
15411544
'!' === $html[ $at ] &&
15421545
'-' === $html[ $at + 1 ] &&
15431546
'-' === $html[ $at + 2 ]
@@ -1561,7 +1564,6 @@ private function skip_script_data(): bool {
15611564
* proceed scanning to the next potential token in the text.
15621565
*/
15631566
if ( ! (
1564-
$at + 6 < $doc_length &&
15651567
( 's' === $html[ $at ] || 'S' === $html[ $at ] ) &&
15661568
( 'c' === $html[ $at + 1 ] || 'C' === $html[ $at + 1 ] ) &&
15671569
( 'r' === $html[ $at + 2 ] || 'R' === $html[ $at + 2 ] ) &&

0 commit comments

Comments
 (0)