Template Part: Improve how the tag name attribute is handled (#62785)

Only valid tags should be allowed rather than characters that can't be a part of HTML tags. Co-authored-by: gziolo <[email protected]> Co-authored-by: aaronjorbin <[email protected]>
WordPress · Jun 24, 2024 · abe0925 · abe0925
1 parent d0d775b
commit abe0925
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/block-library/src/template-part/index.php b/packages/block-library/src/template-part/index.php
@@ -161,7 +161,7 @@ function render_block_core_template_part( $attributes ) {
 	global $wp_embed;
 	$content = $wp_embed->autoembed( $content );
 
-	if ( empty( $attributes['tagName'] ) ) {
+	if ( empty( $attributes['tagName'] ) || tag_escape( $attributes['tagName'] ) !== $attributes['tagName'] ) {
 		$area_tag = 'div';
 		if ( $area_definition && isset( $area_definition['area_tag'] ) ) {
 			$area_tag = $area_definition['area_tag'];