diff --git a/lib/block-supports/index.php b/lib/block-supports/index.php index e43111e097150e..04681050caaad4 100644 --- a/lib/block-supports/index.php +++ b/lib/block-supports/index.php @@ -89,11 +89,13 @@ function gutenberg_apply_block_supports( $block_content, $block ) { // Apply new styles and classes. if ( ! empty( $new_classes ) ) { - $block_root->setAttribute( 'class', esc_attr( implode( ' ', $new_classes ) ) ); + // `DOMElement::setAttribute` handles attribute value escaping. + $block_root->setAttribute( 'class', implode( ' ', $new_classes ) ); } if ( ! empty( $new_styles ) ) { - $block_root->setAttribute( 'style', esc_attr( implode( '; ', $new_styles ) . ';' ) ); + // `DOMElement::setAttribute` handles attribute value escaping. + $block_root->setAttribute( 'style', implode( '; ', $new_styles ) . ';' ); } return $dom->saveHtml( $block_root ); diff --git a/phpunit/class-block-supported-styles-test.php b/phpunit/class-block-supported-styles-test.php index 843f3ea07d81f7..cfd8787fd8d872 100644 --- a/phpunit/class-block-supported-styles-test.php +++ b/phpunit/class-block-supported-styles-test.php @@ -817,4 +817,48 @@ function ( $errno = 0, $errstr = '' ) use ( &$errors ) { $this->assertEmpty( $errors, 'Libxml errors should be dropped.' ); } + + /** + * Ensures block attributes are output correctly. + * + * Some blocks saved with valid attributes were broken after the block was rendered. Ensure that + * block attributes are escaped correctly and safely. + */ + public function test_render_block_attribute() { + $this->register_block_type( 'core/example', array( 'render_callback' => true ) ); + + $block = array( + 'blockName' => 'core/example', + 'attrs' => array(), + ); + + // Tests of shape [ [ $input, $expected_result ], … ]. + $tests = array( + + // Valid single quotes in double-quoted attribute. + array( + '
', + '
', + ), + + // Valid double quotes in single-quoted attribute. + array( + '
', + '
', + ), + + // Encode attributes. + array( + '
', + '
', + ), + ); + + foreach ( $tests as $test ) { + $input = $test[0]; + $expected = $test[1]; + $result = apply_filters( 'render_block', $input, $block ); + $this->assertEquals( $expected, $result ); + } + } }