Changeset 61892

Timestamp:

03/10/2026 01:55:45 PM (3 days ago)

Author:

audrasjb

Message:

HTML API: Prevent WP_HTML_Tag_Processor instances being unserialized and add some extra logic for validating pattern and template file paths.

Merges [61880,61881] to the 6.9 branch.
Props dmsnell, xknown, jonsurrell, peterwilsoncc, johnbillion.

Location:

branches/6.9

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-block-patterns-registry.php (modified) (2 diffs)
• src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (1 diff)
• src/wp-includes/template-loader.php (modified) (1 diff)

branches/6.9/src/wp-includes/class-wp-block-patterns-registry.php

@@ -174 +174 @@
             $patterns = &$this->registered_patterns;
         }
-        if ( ! isset( $patterns[ $pattern_name ]['content'] ) && isset( $patterns[ $pattern_name ]['filePath'] ) ) {
+
+        $pattern_path = realpath( $patterns[ $pattern_name ]['filePath'] ?? '' );
+        if (
+            ! isset( $patterns[ $pattern_name ]['content'] ) &&
+            is_string( $pattern_path ) &&
+            ( str_ends_with( $pattern_path, '.php' ) || str_ends_with( $pattern_path, '.html' ) ) &&
+            is_file( $pattern_path ) &&
+            is_readable( $pattern_path )
+        ) {
             ob_start();
             include $patterns[ $pattern_name ]['filePath'];
@@ -180 +188 @@
             unset( $patterns[ $pattern_name ]['filePath'] );
         }
+
         return $patterns[ $pattern_name ]['content'];
     }

branches/6.9/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -4681 +4681 @@
      */
     const TEXT_IS_WHITESPACE = 'TEXT_IS_WHITESPACE';
+
+    /**
+     * Wakeup magic method.
+     *
+     * @since 6.9.2
+     */
+    public function __wakeup() {
+        throw new \LogicException( __CLASS__ . ' should never be unserialized' );
+    }
 }

branches/6.9/src/wp-includes/template-loader.php

@@ -113 +113 @@
      */
     $template = apply_filters( 'template_include', $template );
-    if ( $template ) {
+    $template = is_string( $template ) ? realpath( $template ) : null;
+    if (
+        is_string( $template ) &&
+        ( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&
+        is_file( $template ) &&
+        is_readable( $template )
+    ) {
         /**
          * Fires immediately before including the template.