Fix regression in `wp.sanitize.stripTags()` when input is `null` or `undefined` #10833

westonruter · 2026-01-31T07:30:23Z

Ensure that wp.sanitize.stripTags() returns an empty string when the input is null or undefined, preventing it from being converted to the string "null" by DOMParser.

Added regression tests.

Trac ticket: https://core.trac.wordpress.org/ticket/64574

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

…efined. Ensure that `wp.sanitize.stripTags()` returns an empty string when the input is `null` or `undefined`, preventing it from being converted to the string "null" by `DOMParser`. Added regression tests. Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

github-actions · 2026-01-31T07:30:32Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props westonruter, mukesh27.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-01-31T07:36:14Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

The Plugin and Theme Directories cannot be accessed within Playground.
All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

westonruter · 2026-01-31T07:36:38Z

tests/qunit/wp-includes/js/wp-sanitize.js

Gemini happily generated all these tests.

What do you think about adding tests for wp.sanitize.stripTags( 0 ), wp.sanitize.stripTags( '0' ) and wp.sanitize.stripTags( '' )? That way, more edge cases would be covered.

Copilot

Pull request overview

Fixes a regression in wp.sanitize.stripTags() where null/undefined inputs could be coerced into the strings "null"/"undefined" via DOMParser, by returning an empty string instead, and adds QUnit regression tests.

Changes:

Add an early-return in wp.sanitize.stripTags() for null/undefined.
Add QUnit coverage for stripTags() and stripTagsAndEncodeText() with null/undefined inputs.
Register the new QUnit test file in the QUnit runner index.html.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`src/js/_enqueues/wp/sanitize.js`	Adds a `null`/`undefined` guard to prevent `"null"`/`"undefined"` string coercion through `DOMParser`.
`tests/qunit/wp-includes/js/wp-sanitize.js`	Introduces regression tests covering `null`/`undefined` and basic behavior for sanitize helpers.
`tests/qunit/index.html`	Ensures the new QUnit test file is loaded by the test runner.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-02T06:25:07Z

src/js/_enqueues/wp/sanitize.js

 		stripTags: function( text ) {
+			if ( null === text || 'undefined' === typeof text ) {
+				return '';
+			}


The JSDoc for stripTags() still declares text as {string}, but the function now explicitly supports null/undefined by returning an empty string (and tests also pass a number). Please update the parameter type (and ideally stripTagsAndEncodeText()'s matching JSDoc) so the documented contract matches the behavior.

I don't think this is necessary. We don't want a non-string value to be passed. Accepting null or undefined is a back-compat consideration.

mukeshpanchal27 · 2026-02-02T07:19:12Z

@westonruter Can you share testing steps please?

westonruter · 2026-02-02T07:35:44Z

@mukeshpanchal27 the ticket description has the reproduction info. I guess go to a screen where that script is enqueued, or enqueued the script yourself, and then run the function in the console.

sirreal · 2026-02-02T10:21:45Z

src/js/_enqueues/wp/sanitize.js

 		 * @return {string} Stripped text.
 		 */
 		stripTags: function( text ) {
+			if ( null === text || 'undefined' === typeof text ) {


Minor: I consider null == text to be the canonical "null or undefined" check, it's well specified behavior.

Is there a reason to use a typeof check? I associate 'undefined' === typeof variable with a test where we don't know whether a variable is defined.

Suggested change

if ( null === text || 'undefined' === typeof text ) {

if ( null == text ) {

Good question. This is part of WordPress's JavaScript Coding Standards on Equality:

Strict equality checks (===) must be used in favor of abstract equality checks (==).

So avoiding the loose comparison is in keeping with the coding standards.

My suggestion is called out specifically as the preferred null or undefined check in those guidelines:

These are the preferred ways of checking the type of an object:

…

null or undefined: object == null

sirreal

The test are running and passing and appear correct.

I'll leave the suggestion to your discretion: https://github.com/WordPress/wordpress-develop/pull/10833/changes#r2753604980

github-actions · 2026-02-02T18:40:17Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 61578
GitHub commit: f8c0213

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

westonruter commented Jan 31, 2026

View reviewed changes

westonruter requested review from Copilot and dmsnell February 2, 2026 06:17

Copilot started reviewing on behalf of westonruter February 2, 2026 06:18 View session

Copilot AI reviewed Feb 2, 2026

View reviewed changes

sirreal reviewed Feb 2, 2026

View reviewed changes

sirreal approved these changes Feb 2, 2026

View reviewed changes

github-actions bot closed this Feb 2, 2026

	if ( null === text \|\| 'undefined' === typeof text ) {
	if ( null == text ) {

Fix regression in wp.sanitize.stripTags() when input is null or undefined #10833

Fix regression in wp.sanitize.stripTags() when input is null or undefined #10833

Conversation

westonruter commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 31, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

westonruter Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Hug0-Drelon Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

westonruter Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

mukeshpanchal27 commented Feb 2, 2026

Uh oh!

westonruter commented Feb 2, 2026

Uh oh!

sirreal Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

westonruter Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

sirreal Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

sirreal left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Fix regression in `wp.sanitize.stripTags()` when input is `null` or `undefined` #10833

Fix regression in `wp.sanitize.stripTags()` when input is `null` or `undefined` #10833

westonruter commented Jan 31, 2026 •

edited

Loading

github-actions bot commented Jan 31, 2026 •

edited

Loading