get_block_wrapper_attributes: Ensures that user-provided attributes override the attributes generated by block supports

[t-hamano]

Note

This PR is the same as #10877. I submitted this new PR because I accidentally closed #10877 and it can no longer be reopened.

Trac ticket: https://core.trac.wordpress.org/ticket/64603

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props wildworks, westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[westonruter]

For posterity, #10877 (comment):

In the case of merging style, should special handling be added to ensure that $extra_attributes[ $attribute_name ] ends in a semicolon? The current empty space is only really appropriate for class.

[t-hamano]

Sorry for the late reply.

After some consideration, I decided to refactor the get_block_wrapper_attributes() function overall to make it more robust and secure.

• Define callback functions that define how to merge or override each attribute.
• Sanitize style and class attribute values
• More flexibly handle redundant semicolons in style attributes
• Added a unit test to directly assert the return value of get_block_wrapper_attributes().

[t-hamano]

Sanitize non-string attribute values here.

[t-hamano]

We shouldn't have used the invalid inline styles in the test in the first place.

[westonruter]

While uncommon, a class name can technically contain a comma. It just has to be escaped in CSS. See CodePen.

The use of wp_parse_list() will split on commas too, as seen in PHP Playground.

So I think it would be safer to just use preg_split() directly:

Suggested change

	wp_parse_list( $extra_attribute ),
	wp_parse_list( $new_attribute )
	preg_split( '/\s+/', $extra_attribute, -1, PREG_SPLIT_NO_EMPTY ),
	preg_split( '/\s+/', $new_attribute, -1, PREG_SPLIT_NO_EMPTY )

[westonruter]

But I guess sanitize_html_class() will strip out commas anyway.

[t-hamano]

Addressed in 66a9169

I also removed sanitize_html_class sanitizing accordingly.

While it's unlikely any developers would include commas in block class names, it's probably best not to introduce new handling for backward compatibility reasons.