Skip to content

Audit wp_json_encode() with appropriate JSON flags #9557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
BugReportOnWeb wants to merge 7 commits into from
Closed

Audit wp_json_encode() with appropriate JSON flags #9557

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0231dbd
fix: audit `wp_json_encode` with appropriate JSON flags inside script…
BugReportOnWeb Aug 21, 2025
115e376
test: add test case for checking wp_localize_script for safe JSON output
BugReportOnWeb Aug 22, 2025
9c5db61
fix: add missing JSON flag for safe output
BugReportOnWeb Aug 22, 2025
5c74cc4
style: fix fomatting as per PHPCS
BugReportOnWeb Aug 22, 2025
0cece84
test: refactor test case for cleaner output
BugReportOnWeb Aug 27, 2025
36ffad5
fix: remove redundant JSON flags
BugReportOnWeb Aug 27, 2025
dab63ba
Merge branch 'trunk' into fix/audit-wp_json_encode
BugReportOnWeb Aug 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/wp-admin/async-upload.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@
$_FILES['async-upload']['name']
);

echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
exit;
}

Expand Down
4 changes: 2 additions & 2 deletions src/wp-admin/customize.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@
?>
<?php wp_print_scripts( array( 'wp-util' ) ); ?>
<script>
wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args ); ?> );
wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
</script>
<?php
$script = ob_get_clean();
Expand Down Expand Up @@ -158,7 +158,7 @@
<title><?php echo esc_html( $admin_title ); ?></title>

<script type="text/javascript">
var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ) ); ?>,
var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>,
pagenow = 'customize';
</script>

Expand Down
12 changes: 6 additions & 6 deletions src/wp-admin/edit-form-blocks.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ static function ( $classes ) {

wp_add_inline_script(
'wp-blocks',
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ) ) ),
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
'after'
);

Expand Down Expand Up @@ -144,7 +144,7 @@ static function ( $classes ) {
// Preload server-registered block schemas.
wp_add_inline_script(
'wp-blocks',
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
);

// Preload server-registered block bindings sources.
Expand All @@ -158,7 +158,7 @@ static function ( $classes ) {
'usesContext' => $source->uses_context,
);
}
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
wp_add_inline_script(
'wp-blocks',
$script
Expand All @@ -178,7 +178,7 @@ static function ( $classes ) {
);
wp_add_inline_script(
'wp-editor',
sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url ) ),
sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
'before'
);

Expand Down Expand Up @@ -364,8 +364,8 @@ static function ( $classes ) {
$init_script,
$post->post_type,
$post->ID,
wp_json_encode( $editor_settings ),
wp_json_encode( $initial_edits )
wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
wp_json_encode( $initial_edits, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
);
wp_add_inline_script( 'wp-edit-post', $script );

Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/class-wp-internal-pointers.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ private static function print_js( $pointer_id, $selector, $args ) {
?>
<script type="text/javascript">
(function($){
var options = <?php echo wp_json_encode( $args ); ?>, setup;
var options = <?php echo wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>, setup;

if ( ! options )
return;
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/class-wp-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1871,6 +1871,6 @@ public function _js_vars() {
),
);

printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args ) );
printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
}
}
2 changes: 1 addition & 1 deletion src/wp-admin/includes/class-wp-privacy-policy-content.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,7 +348,7 @@ public static function notice( $post = null ) {
sprintf(
'wp.data.dispatch( "core/notices" ).createWarningNotice( "%s", { actions: [ %s ], isDismissible: false } )',
$message,
wp_json_encode( $action )
wp_json_encode( $action, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
),
'after'
);
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/class-wp-themes-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -357,7 +357,7 @@ public function _js_vars( $extra_args = array() ) {
$args = array_merge( $args, $extra_args );
}

printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args ) );
printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
parent::_js_vars();
}
}
4 changes: 2 additions & 2 deletions src/wp-admin/includes/media.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,7 @@ function media_send_to_editor( $html ) {
?>
<script type="text/javascript">
var win = window.dialogArguments || opener || parent || top;
win.send_to_editor( <?php echo wp_json_encode( $html ); ?> );
win.send_to_editor( <?php echo wp_json_encode( $html, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
</script>
<?php
exit;
Expand Down Expand Up @@ -2236,7 +2236,7 @@ function media_upload_form( $errors = null ) {

?>
var resize_height = <?php echo $large_size_h; ?>, resize_width = <?php echo $large_size_w; ?>,
wpUploaderInit = <?php echo wp_json_encode( $plupload_init ); ?>;
wpUploaderInit = <?php echo wp_json_encode( $plupload_init, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
</script>

<div id="plupload-upload-ui" class="hide-if-no-js">
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/misc.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1085,7 +1085,7 @@ function wp_color_scheme_settings() {
);
}

echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ) ) . ";</script>\n";
echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ";</script>\n";
}

/**
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/options.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ function options_general_add_js() {
jQuery( function($) {
var $siteName = $( '#wp-admin-bar-site-name' ).children( 'a' ).first(),
$siteIconPreview = $('#site-icon-preview-site-title'),
homeURL = ( <?php echo wp_json_encode( get_home_url() ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );
homeURL = ( <?php echo wp_json_encode( get_home_url(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );

$( '#blogname' ).on( 'input', function() {
var title = $.trim( $( this ).val() ) || homeURL;
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/post.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2442,7 +2442,7 @@ function the_block_editor_meta_boxes() {
* our editor instance.
*/
$script = 'window._wpLoadBlockEditor.then( function() {
wp.data.dispatch( \'core/edit-post\' ).setAvailableMetaBoxesPerLocation( ' . wp_json_encode( $meta_boxes_per_location ) . ' );
wp.data.dispatch( \'core/edit-post\' ).setAvailableMetaBoxesPerLocation( ' . wp_json_encode( $meta_boxes_per_location, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ' );
} );';

wp_add_inline_script( 'wp-edit-post', $script );
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/template.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2479,7 +2479,7 @@ function get_media_states( $post ) {
function compression_test() {
?>
<script type="text/javascript">
var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ) ); ?>;
var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
var testCompression = {
get : function(test) {
var x;
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/plugin-editor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@
'codeEditor' => wp_enqueue_code_editor( array( 'file' => $real_file ) ),
);
wp_enqueue_script( 'wp-theme-plugin-editor' );
wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings ) ) );
wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'wp.themePluginEditor.themeOrPlugin = "plugin";' ) );

require_once ABSPATH . 'wp-admin/admin-header.php';
Expand Down
8 changes: 4 additions & 4 deletions src/wp-admin/site-editor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,14 +257,14 @@ static function ( $classes ) {
'wp.domReady( function() {
wp.editSite.initializeEditor( "site-editor", %s );
} );',
wp_json_encode( $editor_settings )
wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
)
);

// Preload server-registered block schemas.
wp_add_inline_script(
'wp-blocks',
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
);

// Preload server-registered block bindings sources.
Expand All @@ -278,7 +278,7 @@ static function ( $classes ) {
'usesContext' => $source->uses_context,
);
}
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
wp_add_inline_script(
'wp-blocks',
$script
Expand All @@ -287,7 +287,7 @@ static function ( $classes ) {

wp_add_inline_script(
'wp-blocks',
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( isset( $editor_settings['blockCategories'] ) ? $editor_settings['blockCategories'] : array() ) ),
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( isset( $editor_settings['blockCategories'] ) ? $editor_settings['blockCategories'] : array(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
'after'
);

Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/theme-editor.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@
'codeEditor' => wp_enqueue_code_editor( compact( 'file' ) ),
);
wp_enqueue_script( 'wp-theme-plugin-editor' );
wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings ) ) );
wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
wp_add_inline_script( 'wp-theme-plugin-editor', 'wp.themePluginEditor.themeOrPlugin = "theme";' );

require_once ABSPATH . 'wp-admin/admin-header.php';
Expand Down
8 changes: 4 additions & 4 deletions src/wp-admin/widgets-form-blocks.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,14 +41,14 @@
'wp.domReady( function() {
wp.editWidgets.initialize( "widgets-editor", %s );
} );',
wp_json_encode( $editor_settings )
wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
)
);

// Preload server-registered block schemas.
wp_add_inline_script(
'wp-blocks',
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
);

// Preload server-registered block bindings sources.
Expand All @@ -62,7 +62,7 @@
'usesContext' => $source->uses_context,
);
}
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
wp_add_inline_script(
'wp-blocks',
$script
Expand All @@ -71,7 +71,7 @@

wp_add_inline_script(
'wp-blocks',
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
'after'
);

Expand Down
4 changes: 2 additions & 2 deletions src/wp-content/themes/twentytwenty/functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -684,8 +684,8 @@ function twentytwenty_customize_preview_init() {
'twentytwenty-customize-preview',
sprintf(
'wp.customize.selectiveRefresh.partialConstructor[ %1$s ].prototype.attrs = %2$s;',
wp_json_encode( 'cover_opacity' ),
wp_json_encode( twentytwenty_customize_opacity_range() )
wp_json_encode( 'cover_opacity', JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
wp_json_encode( twentytwenty_customize_opacity_range(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
)
);
}
Expand Down
18 changes: 9 additions & 9 deletions src/wp-includes/class-wp-customize-manager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,7 +476,7 @@ protected function wp_die( $ajax_message, $message = null ) {
( function( api, settings ) {
var preview = new api.Messenger( settings.messengerArgs );
preview.send( 'iframe-loading-error', settings.error );
} )( wp.customize, <?php echo wp_json_encode( $settings ); ?> );
} )( wp.customize, <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
</script>
<?php
$message .= wp_get_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) );
Expand Down Expand Up @@ -2205,7 +2205,7 @@ public function customize_preview_settings() {
ob_start();
?>
<script>
var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
_wpCustomizeSettings.values = {};
(function( v ) {
<?php
Expand All @@ -2218,8 +2218,8 @@ public function customize_preview_settings() {
if ( $setting->check_capabilities() ) {
printf(
"v[%s] = %s;\n",
wp_json_encode( $id ),
wp_json_encode( $setting->js_value() )
wp_json_encode( $id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
wp_json_encode( $setting->js_value(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
);
}
}
Expand Down Expand Up @@ -4988,7 +4988,7 @@ public function customize_pane_settings() {
ob_start();
?>
<script>
var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
_wpCustomizeSettings.initialClientTimestamp = _.now();
_wpCustomizeSettings.controls = {};
_wpCustomizeSettings.settings = {};
Expand All @@ -5000,8 +5000,8 @@ public function customize_pane_settings() {
if ( $setting->check_capabilities() ) {
printf(
"s[%s] = %s;\n",
wp_json_encode( $setting->id ),
wp_json_encode( $setting->json() )
wp_json_encode( $setting->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
wp_json_encode( $setting->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
);
}
}
Expand All @@ -5013,8 +5013,8 @@ public function customize_pane_settings() {
if ( $control->check_capabilities() ) {
printf(
"c[%s] = %s;\n",
wp_json_encode( $control->id ),
wp_json_encode( $control->json() )
wp_json_encode( $control->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
wp_json_encode( $control->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
);
}
}
Expand Down
4 changes: 2 additions & 2 deletions src/wp-includes/class-wp-customize-nav-menus.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -545,7 +545,7 @@ public function enqueue_scripts() {
'locationSlugMappedToName' => get_registered_nav_menus(),
);

$data = sprintf( 'var _wpCustomizeNavMenusSettings = %s;', wp_json_encode( $settings ) );
$data = sprintf( 'var _wpCustomizeNavMenusSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
wp_scripts()->add_data( 'customize-nav-menus', 'data', $data );

// This is copied from nav-menus.php, and it has an unfortunate object name of `menus`.
Expand Down Expand Up @@ -1548,7 +1548,7 @@ public function export_preview_data() {
$exports = array(
'navMenuInstanceArgs' => $this->preview_nav_menu_instance_args,
);
wp_print_inline_script_tag( sprintf( 'var _wpCustomizePreviewNavMenusExports = %s;', wp_json_encode( $exports ) ) );
wp_print_inline_script_tag( sprintf( 'var _wpCustomizePreviewNavMenusExports = %s;', wp_json_encode( $exports, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
}

/**
Expand Down
12 changes: 6 additions & 6 deletions src/wp-includes/class-wp-customize-widgets.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -832,7 +832,7 @@ public function enqueue_scripts() {
$wp_scripts->add_data(
'customize-widgets',
'data',
sprintf( 'var _wpCustomizeWidgetsSettings = %s;', wp_json_encode( $settings ) )
sprintf( 'var _wpCustomizeWidgetsSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
);

/*
Expand All @@ -859,14 +859,14 @@ public function enqueue_scripts() {
'wp.domReady( function() {
wp.customizeWidgets.initialize( "widgets-customizer", %s );
} );',
wp_json_encode( $editor_settings )
wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
)
);

// Preload server-registered block schemas.
wp_add_inline_script(
'wp-blocks',
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
);

// Preload server-registered block bindings sources.
Expand All @@ -880,7 +880,7 @@ public function enqueue_scripts() {
'usesContext' => $source->uses_context,
);
}
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
$script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
wp_add_inline_script(
'wp-blocks',
$script
Expand All @@ -889,7 +889,7 @@ public function enqueue_scripts() {

wp_add_inline_script(
'wp-blocks',
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
'after'
);

Expand Down Expand Up @@ -1334,7 +1334,7 @@ public function export_preview_data() {
unset( $registered_widget['callback'] ); // May not be JSON-serializable.
}
wp_print_inline_script_tag(
sprintf( 'var _wpWidgetCustomizerPreviewSettings = %s;', wp_json_encode( $settings ) )
sprintf( 'var _wpWidgetCustomizerPreviewSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
);
}

Expand Down
Loading
Loading