From f477c00fdc48ada6986e29eaf699a5e151ad8eea Mon Sep 17 00:00:00 2001
From: audrasjb <audrasjb@git.wordpress.org>
Date: Tue, 16 May 2023 14:23:19 +0000
Subject: [PATCH] Editor: Ensure block comments are of a valid form.

Ensures that the block delimiter comments are of a valid form: opening with `<!--` and closing with `-->`.

Props xknown, isabel_brison, peterwilsoncc.


Built from https://develop.svn.wordpress.org/trunk@55762


git-svn-id: http://core.svn.wordpress.org/trunk@55274 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/blocks.php  | 17 +++++++++++++++++
 wp-includes/version.php |  2 +-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/wp-includes/blocks.php b/wp-includes/blocks.php
index df88b9b59f..159af66331 100644
--- a/wp-includes/blocks.php
+++ b/wp-includes/blocks.php
@@ -800,6 +800,10 @@ function serialize_blocks( $blocks ) {
 function filter_block_content( $text, $allowed_html = 'post', $allowed_protocols = array() ) {
 	$result = '';
 
+	if ( false !== strpos( $text, '<!--' ) && false !== strpos( $text, '--->' ) ) {
+		$text = preg_replace_callback( '%<!--(.*?)--->%', '_filter_block_content_callback', $text );
+	}
+
 	$blocks = parse_blocks( $text );
 	foreach ( $blocks as $block ) {
 		$block   = filter_block_kses( $block, $allowed_html, $allowed_protocols );
@@ -809,6 +813,19 @@ function filter_block_content( $text, $allowed_html = 'post', $allowed_protocols
 	return $result;
 }
 
+/**
+ * Callback used for regular expression replacement in filter_block_content().
+ *
+ * @private
+ * @since 6.2.1
+ *
+ * @param array $matches Array of preg_replace_callback matches.
+ * @return string Replacement string.
+ */
+function _filter_block_content_callback( $matches ) {
+	return '<!--' . rtrim( $matches[1], '-' ) . '-->';
+}
+
 /**
  * Filters and sanitizes a parsed block to remove non-allowable HTML
  * from block attribute values.
diff --git a/wp-includes/version.php b/wp-includes/version.php
index cb36f50df7..e368482e9f 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.3-alpha-55761';
+$wp_version = '6.3-alpha-55762';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.