Repository navigation
Interactivity API: Show the data-wp-html fallback on created elements under Trusted Types - #84924
Open
luisherranz wants to merge 5 commits into
Open
luisherranz wants to merge 5 commits into
luisherranz wants to merge 5 commits into
Conversation
luisherranz
requested review from
DAreRodz,
fabiankaegy and
juanmaguitar
as code owners
October 16, 2026 11:32
🤖 PR meta 🤖🎉 PropsIf you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. Updated as activity occurs, without notifying anyone named here. Add the 📦 Bundle sizeSize Change: +242 B (0%) Total Size: 8.85 MB 📦 View Changed
⚡ PerformanceShow the resultsClient side metrics exclude the server response time. front-end-block-theme
front-end-classic-theme
media-processing
media-upload
post-editor
site-editor
|
5 of 10 tasks
Base automatically changed from
add/interactivity-data-wp-html-server-representation
to
trunk
October 16, 2026 12:27
luisherranz
commented
Oct 16, 2026
… by copying its nodes
Co-authored-by: Luis Herranz <luisherranz@gmail.com>
luisherranz
force-pushed
the
fix/interactivity-data-wp-html-created-element-fallback
branch
from
October 16, 2026 13:22
682a4e9 to
e22c7ca
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Follow-up to #84652 and #84889.
Elements the client creates instead of hydrating, such as
data-wp-eachitems added after hydration or elements a client-side navigation adds, now show theirdata-wp-htmlfallback on sites enforcing Trusted Types while their value is pending or{ "wpServerHtml": true }. This removes the known limitation documented in #84652.Why?
When Preact creates an element, it writes
dangerouslySetInnerHTML.__htmlwithinnerHTML. While the value was pending, the directive handed Preact the fallback as a plain string, so a site enforcing Trusted Types rejected it, or a default policy rewrote it. Created elements on those sites therefore had to have an empty fallback. The package deliberately creates no Trusted Types policy of its own, so writing the fallback as a string can't be made to work.How?
toVdom()keeps a detached copy of eachdata-wp-htmlelement's content, next to the existing string, without its<script>elements (getHtmlFallback()).importNode()when the element is empty and its value is pending or the server representation. Cloning and inserting nodes isn't a Trusted Types sink. Later values follow the existing value rule, and the fallback doesn't come back after a value empties the element.divfor aspanat the same position, and the old host's record would otherwise leave the new host empty.<script>elements are left out of the copy so they never run. Scripts written withinnerHTMLnever ran either, but inserted copies of template content would.Trade-off: the copy is taken for every
data-wp-htmlelement each timetoVdom()runs (the initial page and every page the router fetches), even when the value is a token. It can't be taken lazily, because the original element may have changed by the time a new host needs it.Testing Instructions
test/directive-htmlblock.?require_trusted_types=trueappended to the URL. The response carriesContent-Security-Policy: require-trusted-types-for 'script'.window.fallbackRunsstaysundefined.npm run test:unit:vitest -- packages/interactivitynpm run test:e2e -- test/e2e/specs/interactivity/directive-html.spec.ts test/e2e/specs/interactivity/router-html.spec.tsTesting Instructions for Keyboard
No UI changes.
Use of AI Tools
100% of the code, tests, and comments in this PR were autonomously generated by AI and reviewed by @luisherranz before the PR was opened.