Skip to content
This repository was archived by the owner on Aug 18, 2026. It is now read-only.

fix: Remove scripts and styles - #282

Merged
leogermani merged 1 commit into
Automattic:trunkfrom
Takshil-Kunadia:fix/script-content-leaking
Sep 24, 2025
Merged

fix: Remove scripts and styles#282
leogermani merged 1 commit into
Automattic:trunkfrom
Takshil-Kunadia:fix/script-content-leaking

Conversation

@Takshil-Kunadia

Copy link
Copy Markdown
Contributor

Changes proposed in this Pull Request:

Closes https://linear.app/a8c/issue/NPMIG-1709/rtt-remove-javascript-code-from-text-only-version .

This PR adds code to remove <script> and <style> tags along with their content before wp_kses processing.

The issue occurred because wp_kses strips HTML tags but leaves their content, causing JavaScript code and CSS to appear as plain text in the republished content. This fix removes the tags and their content entirely before the wp_kses filtering step.

How to test the changes in this Pull Request:

  1. Create a test post with embedded <script> tags containing JavaScript code and <style> tags with CSS.
  2. Open the Republication Tracker Tool modal for that post.
  3. Verify that the JavaScript code and CSS styles do not appear in either the HTML textarea or the plain text version.
  4. Test the same with republish template as well.

@leogermani
leogermani merged commit aa2b33d into Automattic:trunk Sep 24, 2025
3 of 4 checks passed
matticbot pushed a commit that referenced this pull request Sep 25, 2025
# [2.7.0-alpha.1](v2.6.2...v2.7.0-alpha.1) (2025-09-25)

### Bug Fixes

* indentation ([dbc2b49](dbc2b49))
* removing scripts and styles ([#282](#282)) ([aa2b33d](aa2b33d))
* update download URL for db.php ([#280](#280)) ([5f42bd1](5f42bd1))

### Features

* add filters for tracking markup snippets ([cffecb0](cffecb0))
@matticbot

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 2.7.0-alpha.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

matticbot pushed a commit that referenced this pull request Oct 6, 2025
# [2.7.0](v2.6.2...v2.7.0) (2025-10-06)

### Bug Fixes

* indentation ([dbc2b49](dbc2b49))
* removing scripts and styles ([#282](#282)) ([aa2b33d](aa2b33d))
* update download URL for db.php ([#280](#280)) ([5f42bd1](5f42bd1))

### Features

* add filters for tracking markup snippets ([cffecb0](cffecb0))
@matticbot

Copy link
Copy Markdown
Contributor

🎉 This PR is included in version 2.7.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

adekbadek pushed a commit to Automattic/newspack-workspace that referenced this pull request Apr 27, 2026
adekbadek pushed a commit to Automattic/newspack-workspace that referenced this pull request Apr 27, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants