88 */
99
1010class WP_HTML_Template {
11+ /**
12+ * Map of characters to their HTML entity equivalents for escaping.
13+ *
14+ * @since 7.1.0
15+ *
16+ * @var array<string, string>
17+ */
18+ private const ESCAPE_MAP = array (
19+ '& ' => '& ' ,
20+ '< ' => '< ' ,
21+ '> ' => '> ' ,
22+ "' " => '' ' ,
23+ '" ' => '" ' ,
24+ );
25+
1126 /**
1227 * The template string.
1328 *
@@ -176,20 +191,12 @@ private static function process( self $template, WP_HTML_Processor $processor ):
176191 $ output = '' ;
177192 $ used_keys = array ();
178193
179- $ escape_map = array (
180- '& ' => '& ' ,
181- '< ' => '< ' ,
182- '> ' => '> ' ,
183- "' " => '' ' ,
184- '" ' => '" ' ,
185- );
186-
187194 while ( $ processor ->next_token () ) {
188195 $ token_type = $ processor ->get_token_type ();
189196
190197 switch ( $ token_type ) {
191198 case '#funky-comment ' :
192- $ result = static ::process_placeholder ( $ processor , $ template , $ escape_map , $ used_keys );
199+ $ result = static ::process_placeholder ( $ processor , $ template , $ used_keys );
193200 if ( false === $ result ) {
194201 return false ;
195202 }
@@ -206,7 +213,7 @@ private static function process( self $template, WP_HTML_Processor $processor ):
206213 $ output .= $ processor ->serialize_token ();
207214 break ;
208215 }
209- $ result = static ::process_tag ( $ processor , $ template , $ escape_map , $ used_keys );
216+ $ result = static ::process_tag ( $ processor , $ template , $ used_keys );
210217 if ( false === $ result ) {
211218 return false ;
212219 }
@@ -247,14 +254,12 @@ private static function process( self $template, WP_HTML_Processor $processor ):
247254 *
248255 * @param WP_HTML_Processor $processor The processor positioned at a funky comment.
249256 * @param self $template The template with replacements.
250- * @param array $escape_map The character escape map.
251257 * @param array &$used_keys Tracks which replacement keys have been used.
252258 * @return string|false|null The replacement string, false on error, or null if not a placeholder.
253259 */
254260 private static function process_placeholder (
255261 WP_HTML_Processor $ processor ,
256262 self $ template ,
257- array $ escape_map ,
258263 array &$ used_keys
259264 ): string |false |null {
260265 $ text = $ processor ->get_modifiable_text ();
@@ -292,7 +297,7 @@ private static function process_placeholder(
292297 $ used_keys [ $ placeholder ] = true ;
293298
294299 if ( is_string ( $ value ) ) {
295- return strtr ( $ value , $ escape_map );
300+ return strtr ( $ value , self :: ESCAPE_MAP );
296301 }
297302
298303 if ( $ value instanceof self ) {
@@ -342,14 +347,12 @@ private static function process_placeholder(
342347 *
343348 * @param WP_HTML_Processor $processor The processor positioned at an opening tag.
344349 * @param self $template The template with replacements.
345- * @param array $escape_map The character escape map.
346350 * @param array &$used_keys Tracks which replacement keys have been used.
347351 * @return string|false The serialized tag HTML, or false on error.
348352 */
349353 private static function process_tag (
350354 WP_HTML_Processor $ processor ,
351355 self $ template ,
352- array $ escape_map ,
353356 array &$ used_keys
354357 ): string |false {
355358 $ attributes = $ processor ->get_tag_attributes ();
@@ -412,7 +415,6 @@ private static function process_tag(
412415 $ raw_value ,
413416 $ attribute ,
414417 $ template ,
415- $ escape_map ,
416418 $ used_keys ,
417419 $ skip_attributes
418420 );
@@ -473,7 +475,6 @@ private static function process_tag(
473475 * @param string $raw_value The raw attribute value from the HTML.
474476 * @param object $attribute The attribute token object.
475477 * @param self $template The template with replacements.
476- * @param array $escape_map The character escape map.
477478 * @param array &$used_keys Tracks which replacement keys have been used.
478479 * @param array &$skip_attributes Attributes to skip in serialization.
479480 * @return string|false|null The serialized attribute, false on error, or null if removed.
@@ -482,7 +483,6 @@ private static function process_attribute_value(
482483 string $ raw_value ,
483484 $ attribute ,
484485 self $ template ,
485- array $ escape_map ,
486486 array &$ used_keys ,
487487 array &$ skip_attributes
488488 ): string |false |null {
@@ -575,11 +575,11 @@ private static function process_attribute_value(
575575 if ( $ match_start > $ offset ) {
576576 $ segment = substr ( $ raw_value , $ offset , $ match_start - $ offset );
577577 $ decoded = WP_HTML_Decoder::decode_attribute ( $ segment );
578- $ value_html .= strtr ( $ decoded , $ escape_map );
578+ $ value_html .= strtr ( $ decoded , self :: ESCAPE_MAP );
579579 }
580580
581581 // Escaped replacement value.
582- $ value_html .= strtr ( $ value , $ escape_map );
582+ $ value_html .= strtr ( $ value , self :: ESCAPE_MAP );
583583
584584 $ offset = $ match_start + $ match_length ;
585585 }
@@ -588,7 +588,7 @@ private static function process_attribute_value(
588588 if ( $ offset < $ end ) {
589589 $ segment = substr ( $ raw_value , $ offset );
590590 $ decoded = WP_HTML_Decoder::decode_attribute ( $ segment );
591- $ value_html .= strtr ( $ decoded , $ escape_map );
591+ $ value_html .= strtr ( $ decoded , self :: ESCAPE_MAP );
592592 }
593593
594594 return ' ' . $ attribute ->name . '=" ' . $ value_html . '" ' ;
0 commit comments