Changeset 61880

Timestamp:

03/10/2026 12:19:38 PM (3 days ago)

Author:

johnbillion

Message:

HTML API: Prevent WP_HTML_Tag_Processor instances being unserialized and add some extra logic for validating pattern and template file paths.

Props dmsnell, xknown, jonsurrell, peterwilsoncc, johnbillion.

Location:

trunk/src/wp-includes

Files:

• class-wp-block-patterns-registry.php (modified) (2 diffs)
• class-wp-http-ixr-client.php (modified) (1 diff)
• html-api/class-wp-html-tag-processor.php (modified) (1 diff)
• template-loader.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-block-patterns-registry.php

@@ -174 +174 @@
             $patterns = &$this->registered_patterns;
         }
-        if ( ! isset( $patterns[ $pattern_name ]['content'] ) && isset( $patterns[ $pattern_name ]['filePath'] ) ) {
+
+        $pattern_path = realpath( $patterns[ $pattern_name ]['filePath'] ?? '' );
+        if (
+            ! isset( $patterns[ $pattern_name ]['content'] ) &&
+            is_string( $pattern_path ) &&
+            ( str_ends_with( $pattern_path, '.php' ) || str_ends_with( $pattern_path, '.html' ) ) &&
+            is_file( $pattern_path ) &&
+            is_readable( $pattern_path )
+        ) {
             ob_start();
             include $patterns[ $pattern_name ]['filePath'];
@@ -180 +188 @@
             unset( $patterns[ $pattern_name ]['filePath'] );
         }
+
         return $patterns[ $pattern_name ]['content'];
     }

trunk/src/wp-includes/class-wp-http-ixr-client.php

@@ -90 +90 @@
         }
 
-        $response = wp_safe_remote_post( $url, $args );
+        $response = wp_remote_post( $url, $args );
 
         if ( is_wp_error( $response ) ) {

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -5062 +5062 @@
      */
     const TEXT_IS_WHITESPACE = 'TEXT_IS_WHITESPACE';
+
+    /**
+     * Wakeup magic method.
+     *
+     * @since 6.9.2
+     */
+    public function __wakeup() {
+        throw new \LogicException( __CLASS__ . ' should never be unserialized' );
+    }
 }

trunk/src/wp-includes/template-loader.php

@@ -113 +113 @@
      */
     $template = apply_filters( 'template_include', $template );
-    if ( $template ) {
+    $template = is_string( $template ) ? realpath( $template ) : null;
+    if (
+        is_string( $template ) &&
+        ( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&
+        is_file( $template ) &&
+        is_readable( $template )
+    ) {
         /**
          * Fires immediately before including the template.