From b64aa36aa3a8033fe8d1b89fba1a5c62c72b081f Mon Sep 17 00:00:00 2001
From: Jb Audras <audrasjb@git.wordpress.org>
Date: Tue, 16 May 2023 14:21:35 +0000
Subject: [PATCH] Editor: Ensure block comments are of a valid form.

Ensures that the block delimiter comments are of a valid form: opening with `<!--` and closing with `-->`.

Props xknown, isabel_brison, peterwilsoncc.



git-svn-id: https://develop.svn.wordpress.org/trunk@55762 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/blocks.php | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/wp-includes/blocks.php b/src/wp-includes/blocks.php
index df88b9b59f..159af66331 100644
--- a/src/wp-includes/blocks.php
+++ b/src/wp-includes/blocks.php
@@ -800,6 +800,10 @@ function serialize_blocks( $blocks ) {
 function filter_block_content( $text, $allowed_html = 'post', $allowed_protocols = array() ) {
 	$result = '';
 
+	if ( false !== strpos( $text, '<!--' ) && false !== strpos( $text, '--->' ) ) {
+		$text = preg_replace_callback( '%<!--(.*?)--->%', '_filter_block_content_callback', $text );
+	}
+
 	$blocks = parse_blocks( $text );
 	foreach ( $blocks as $block ) {
 		$block   = filter_block_kses( $block, $allowed_html, $allowed_protocols );
@@ -809,6 +813,19 @@ function filter_block_content( $text, $allowed_html = 'post', $allowed_protocols
 	return $result;
 }
 
+/**
+ * Callback used for regular expression replacement in filter_block_content().
+ *
+ * @private
+ * @since 6.2.1
+ *
+ * @param array $matches Array of preg_replace_callback matches.
+ * @return string Replacement string.
+ */
+function _filter_block_content_callback( $matches ) {
+	return '<!--' . rtrim( $matches[1], '-' ) . '-->';
+}
+
 /**
  * Filters and sanitizes a parsed block to remove non-allowable HTML
  * from block attribute values.