Repository navigation
Interactivity API: Choose the data-wp-html placeholder marker in linear time. - #15541
Closed
luisherranz wants to merge 3 commits into
Closed
luisherranz wants to merge 3 commits into
luisherranz wants to merge 3 commits into
Conversation
…near time. `WP_Interactivity_API::process_directives()` holds back the trusted HTML of each `data-wp-html` host behind a placeholder comment, whose marker must occur nowhere in the input. The marker was chosen by appending one underscore at a time and searching the whole input again after each one, so input holding `wp-interactivity-dangerous-html` followed by a long run of underscores took quadratic time. The search runs for every input that holds `data-wp-`, whether or not a `data-wp-html` host renders. The marker is now chosen in a single pass over the input. It is the base followed by one more underscore than the longest run of underscores that follows the base anywhere in the input, or the base alone when the input does not hold it. This is the marker the previous loop chose, so the output does not change. Follow-up to [64386]. Props jonsurrell. Fixes #66498.
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. Props Bot commandsYou can trigger Props Bot actions by commenting on this PR:
|
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
sirreal
reviewed
Nov 6, 2026
sirreal
left a comment
sirreal
left a comment
Member
There was a problem hiding this comment.
I'd recommend changing to a unique marker and dropping the loop.
…r call from a UUID. `WP_Interactivity_API::process_directives()` holds back the trusted HTML of each `data-wp-html` host behind a placeholder comment, whose marker identifies the placeholders of that call. The previous commit chose the marker by scanning the input for the longest run of underscores that follows the base. The marker is now the base followed by a UUID from `wp_generate_uuid4()`. The first host of a call that renders draws it, and the later hosts of the call reuse it. Nothing reads the input to choose it, and the placeholders keep a fixed length. A call in which no host renders draws no marker, so ordinary calls take no longer than before. `test_substitution_cannot_be_forged` now also covers a lookalike of the new placeholder form that holds another UUID. `test_inserted_html_is_not_searched_for_placeholders` is removed: with a marker drawn per call, its token's HTML can no longer equal another host's placeholder. Props jonsurrell. See #66498.
sirreal
approved these changes
Nov 6, 2026
Merge public trunk at e4cfb66. Preserve lazy per-call UUID markers alongside nested scope restoration and forward-only balanced-tag processing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Choose the
data-wp-htmlplaceholder marker inWP_Interactivity_API::process_directives()without searching the input, so this step no longer depends on what the input contains.Why
The marker identifies the placeholders of one call, so it must not be something the input can forge. It was chosen by adding one underscore at a time and searching the whole input again after each one. That made the cost of this step depend on what the input contains, not only on its length. The step runs for every input that contains
data-wp-.How
As suggested in review, the marker is
wp-interactivity-dangerous-html-followed by a UUID fromwp_generate_uuid4(). The firstdata-wp-htmlhost of a call that renders draws it, and the later hosts of the call reuse it. Nothing searches the input for it, and the placeholders keep a fixed length. The rendered output doesn't change.A call in which no host renders draws nothing. Drawing the UUID on every call made the default theme's per-block calls a few microseconds slower than before, so the first host draws it.
test_substitution_cannot_be_forgednow covers a lookalike of the new placeholder form that holds another UUID.test_inserted_html_is_not_searched_for_placeholdersis removed: with a marker drawn per call, its token's HTML can no longer equal another host's placeholder.Trac ticket: https://core.trac.wordpress.org/ticket/66498
Use of AI Tools
AI assistance: Yes
Tool(s): OpenCode
Model(s): Claude Opus 5.5, Claude Sonnet 5.5, GPT-6.1 Sol, GPT-6 Luna, GPT-6 Astra
Used for: 100% of the code, tests, and comments in this PR were autonomously generated by AI and reviewed by @luisherranz before the PR was opened.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.