From c98f64d7557869506e09f1d0bc2bccfe2d919008 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Fri, 2 Aug 2024 14:06:59 +0200
Subject: [PATCH 1/6] Add test case for infinite loop in skip_script_data

---
 .../phpunit/tests/html-api/wpHtmlTagProcessor.php  | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php
index fceaaddb04af6..7afb4aa7e01c3 100644
--- a/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php
+++ b/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php
@@ -2875,4 +2875,18 @@ public function insert_after( $new_html ) {
 			'Should have properly applied the update from in front of the cursor.'
 		);
 	}
+
+	/**
+	 * Test an infinite loop bugfix in script tag processing.
+	 *
+	 * @small
+	 *
+	 * @ticket TBD
+	 */
+	public function test_script_tag_processing_no_infinite_loop() {
+		$processor = new WP_HTML_Tag_Processor( '<script type="data">-' );
+
+		$this->assertFalse( $processor->next_tag() );
+		$this->assertTrue( $processor->paused_at_incomplete_token() );
+	}
 }

From 8da0bd1c434f42ad4cc611d886e176b29b3301d8 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Thu, 1 Aug 2024 17:29:25 +0200
Subject: [PATCH 2/6] Fix infinite loop in skip_script_data

---
 src/wp-includes/html-api/class-wp-html-tag-processor.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index c619806525732..d972bef98b5c3 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -1432,7 +1432,8 @@ private function skip_script_data(): bool {
 			}
 
 			// Everything of interest past here starts with "<".
-			if ( $at + 1 >= $doc_length || '<' !== $html[ $at++ ] ) {
+			if ( $at + 1 >= $doc_length || '<' !== $html[ $at + 1 ] ) {
+				$at += 1;
 				continue;
 			}
 

From 8c3fe3afb4f5af49a10202c72609af548c46cf25 Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Fri, 2 Aug 2024 15:50:58 +0200
Subject: [PATCH 3/6] Use prefix increment consistent with the rest of the
 method

---
 src/wp-includes/html-api/class-wp-html-tag-processor.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index d972bef98b5c3..4de8f954752b9 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -1433,7 +1433,7 @@ private function skip_script_data(): bool {
 
 			// Everything of interest past here starts with "<".
 			if ( $at + 1 >= $doc_length || '<' !== $html[ $at + 1 ] ) {
-				$at += 1;
+				++$at;
 				continue;
 			}
 

From b8f00278f756e7cf2b00e40180b82a842db8521f Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Fri, 2 Aug 2024 17:06:06 +0200
Subject: [PATCH 4/6] Fix the infinite loop by ensuring advance is reached

The infinite loop was caused by the parser-advancing increment not being
called when two `||` OR conditions short-circuited. If the first
condition was true, the `$at++` code was never reached.

This was the case if the parser was stopped on the final character "-"
or "<" as the final character of input HTML in an open script tag.
---
 .../html-api/class-wp-html-tag-processor.php         | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index 4de8f954752b9..e940c01a7d175 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -1431,9 +1431,15 @@ private function skip_script_data(): bool {
 				continue;
 			}
 
-			// Everything of interest past here starts with "<".
-			if ( $at + 1 >= $doc_length || '<' !== $html[ $at + 1 ] ) {
-				++$at;
+			if ( $at + 1 >= $doc_length ) {
+				break;
+			}
+
+			/*
+			 * Everything of interest past here starts with "<".
+			 * Check this character and advance position regardless.
+			 */
+			if ( '<' !== $html[ $at++ ] ) {
 				continue;
 			}
 

From 663b94abfff7fd81edd7ea8e7c3eab4b82c8702e Mon Sep 17 00:00:00 2001
From: Jon Surrell <sirreal@users.noreply.github.com>
Date: Fri, 2 Aug 2024 17:17:00 +0200
Subject: [PATCH 5/6] Update tests with ticket and another case

---
 .../tests/html-api/wpHtmlTagProcessor.php     | 22 +++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php b/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php
index 7afb4aa7e01c3..637aa38751688 100644
--- a/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php
+++ b/tests/phpunit/tests/html-api/wpHtmlTagProcessor.php
@@ -2877,14 +2877,28 @@ public function insert_after( $new_html ) {
 	}
 
 	/**
-	 * Test an infinite loop bugfix in script tag processing.
+	 * Test an infinite loop bugfix in incomplete script tag parsing.
 	 *
 	 * @small
 	 *
-	 * @ticket TBD
+	 * @ticket 61810
 	 */
-	public function test_script_tag_processing_no_infinite_loop() {
-		$processor = new WP_HTML_Tag_Processor( '<script type="data">-' );
+	public function test_script_tag_processing_no_infinite_loop_final_dash() {
+		$processor = new WP_HTML_Tag_Processor( '<script>-' );
+
+		$this->assertFalse( $processor->next_tag() );
+		$this->assertTrue( $processor->paused_at_incomplete_token() );
+	}
+
+	/**
+	 * Test an infinite loop bugfix in incomplete script tag parsing.
+	 *
+	 * @small
+	 *
+	 * @ticket 61810
+	 */
+	public function test_script_tag_processing_no_infinite_loop_final_left_angle_bracket() {
+		$processor = new WP_HTML_Tag_Processor( '<script><' );
 
 		$this->assertFalse( $processor->next_tag() );
 		$this->assertTrue( $processor->paused_at_incomplete_token() );

From aa92098e1439b81454db9bc32195fd3a75bae0c0 Mon Sep 17 00:00:00 2001
From: Dennis Snell <dennis.snell@automattic.com>
Date: Fri, 2 Aug 2024 16:23:23 -0700
Subject: [PATCH 6/6] Return early instead of breaking to the end of the
 function.

---
 src/wp-includes/html-api/class-wp-html-tag-processor.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index be1ca0d50b375..7a53fbea1e273 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -1432,7 +1432,7 @@ private function skip_script_data(): bool {
 			}
 
 			if ( $at + 1 >= $doc_length ) {
-				break;
+				return false;
 			}
 
 			/*