From 46ecc04b53256f326608e24f6224e08b966e3fcd Mon Sep 17 00:00:00 2001
From: Tonya Mork <tonya.mork@automattic.com>
Date: Wed, 13 Sep 2023 12:00:08 -0500
Subject: [PATCH] Font Face: backport from Core [56500] (#54218)

* Merges the changes made in Core while retaining plugin specifics.
* Adds `@core-merge` notes where appropriate.

References:
* https://core.trac.wordpress.org/changeset/56500
* https://core.trac.wordpress.org/changeset/56540
---
 .../font-face/class-wp-font-face-resolver.php |   4 +-
 .../fonts/font-face/class-wp-font-face.php    | 110 ++++++++++--------
 lib/compat/wordpress-6.4/fonts/fonts.php      |  29 ++++-
 phpunit/tests/fonts/font-face/base.php        |  73 ++----------
 .../font-face/wpFontFace/generateAndPrint.php |  10 +-
 .../getFontsFromThemeJson.php                 |  12 +-
 .../fonts/font-face/wpPrintFontFaces.php      |  36 ++++--
 7 files changed, 143 insertions(+), 131 deletions(-)

diff --git a/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face-resolver.php b/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face-resolver.php
index 84375b6c52f5d4..7f397663df961b 100644
--- a/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face-resolver.php
+++ b/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face-resolver.php
@@ -5,6 +5,8 @@
  * @package    WordPress
  * @subpackage Fonts
  * @since      6.4.0
+ *
+ * @core-merge: this file is located in `wp-includes/fonts/`.
  */
 
 if ( class_exists( 'WP_Font_Face_Resolver' ) ) {
@@ -33,7 +35,7 @@ public static function get_fonts_from_theme_json() {
 		$settings = gutenberg_get_global_settings();
 
 		// Bail out early if there are no font settings.
-		if ( empty( $settings['typography'] ) || empty( $settings['typography']['fontFamilies'] ) ) {
+		if ( empty( $settings['typography']['fontFamilies'] ) ) {
 			return array();
 		}
 
diff --git a/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face.php b/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face.php
index 0489fe4f4fbd52..8bb1d55414854f 100644
--- a/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face.php
+++ b/lib/compat/wordpress-6.4/fonts/font-face/class-wp-font-face.php
@@ -5,6 +5,8 @@
  * @package    WordPress
  * @subpackage Fonts
  * @since      6.4.0
+ *
+ * @core-merge: this file is located in `wp-includes/fonts/`.
  */
 
 if ( class_exists( 'WP_Font_Face' ) ) {
@@ -82,23 +84,6 @@ class WP_Font_Face {
 	 * @since 6.4.0
 	 */
 	public function __construct() {
-		/**
-		 * Filters the font-face property defaults.
-		 *
-		 * @since 6.4.0
-		 *
-		 * @param array $defaults {
-		 *     An array of required font-face properties and defaults.
-		 *
-		 *     @type string $provider     The provider ID. Default 'local'.
-		 *     @type string $font-family  The font-family property. Default empty string.
-		 *     @type string $font-style   The font-style property. Default 'normal'.
-		 *     @type string $font-weight  The font-weight property. Default '400'.
-		 *     @type string $font-display The font-display property. Default 'fallback'.
-		 * }
-		 */
-		$this->font_face_property_defaults = apply_filters( 'wp_font_face_property_defaults', $this->font_face_property_defaults );
-
 		if (
 			function_exists( 'is_admin' ) && ! is_admin()
 			&&
@@ -113,7 +98,9 @@ function_exists( 'current_theme_supports' ) && ! current_theme_supports( 'html5'
 	 *
 	 * @since 6.4.0
 	 *
-	 * @param array $fonts The fonts to generate and print @font-face styles.
+	 * @param array[][] $fonts Optional. The font-families and their font variations.
+	 *                         See {@see wp_print_font_faces()} for the supported fields.
+	 *                         Default empty array.
 	 */
 	public function generate_and_print( array $fonts ) {
 		$fonts = $this->validate_fonts( $fonts );
@@ -123,10 +110,21 @@ public function generate_and_print( array $fonts ) {
 			return;
 		}
 
-		printf(
-			$this->get_style_element(),
-			$this->get_css( $fonts )
-		);
+		$css = $this->get_css( $fonts );
+
+		/*
+		 * The font-face CSS is contained within <style> tags and can only be interpreted
+		 * as CSS in the browser. Using wp_strip_all_tags() is sufficient escaping
+		 * to avoid malicious attempts to close </style> and open a <script>.
+		 */
+		$css = wp_strip_all_tags( $css );
+
+		// Bail out if there is no CSS to print.
+		if ( empty( $css ) ) {
+			return;
+		}
+
+		printf( $this->get_style_element(), $css );
 	}
 
 	/**
@@ -142,7 +140,7 @@ private function validate_fonts( array $fonts ) {
 
 		foreach ( $fonts as $font_faces ) {
 			foreach ( $font_faces as $font_face ) {
-				$font_face = $this->validate_font_face_properties( $font_face );
+				$font_face = $this->validate_font_face_declarations( $font_face );
 				// Skip if failed validation.
 				if ( false === $font_face ) {
 					continue;
@@ -156,41 +154,59 @@ private function validate_fonts( array $fonts ) {
 	}
 
 	/**
-	 * Validates each font-face property.
+	 * Validates each font-face declaration (property and value pairing).
 	 *
 	 * @since 6.4.0
 	 *
-	 * @param array $font_face Font face properties to validate.
-	 * @return false|array Validated font-face on success. Else, false.
+	 * @param array $font_face Font face property and value pairings to validate.
+	 * @return array|false Validated font-face on success, or false on failure.
 	 */
-	private function validate_font_face_properties( array $font_face ) {
+	private function validate_font_face_declarations( array $font_face ) {
 		$font_face = wp_parse_args( $font_face, $this->font_face_property_defaults );
 
 		// Check the font-family.
 		if ( empty( $font_face['font-family'] ) || ! is_string( $font_face['font-family'] ) ) {
-			trigger_error( 'Font font-family must be a non-empty string.' );
+			// @todo replace with `wp_trigger_error()`.
+			_doing_it_wrong(
+				__METHOD__,
+				__( 'Font font-family must be a non-empty string.' ),
+				'6.4.0'
+			);
 			return false;
 		}
 
 		// Make sure that local fonts have 'src' defined.
 		if ( empty( $font_face['src'] ) || ( ! is_string( $font_face['src'] ) && ! is_array( $font_face['src'] ) ) ) {
-			trigger_error( 'Font src must be a non-empty string or an array of strings.' );
+			// @todo replace with `wp_trigger_error()`.
+			_doing_it_wrong(
+				__METHOD__,
+				__( 'Font src must be a non-empty string or an array of strings.' ),
+				'6.4.0'
+			);
 			return false;
 		}
 
 		// Validate the 'src' property.
-		if ( ! empty( $font_face['src'] ) ) {
-			foreach ( (array) $font_face['src'] as $src ) {
-				if ( empty( $src ) || ! is_string( $src ) ) {
-					trigger_error( 'Each font src must be a non-empty string.' );
-					return false;
-				}
+		foreach ( (array) $font_face['src'] as $src ) {
+			if ( empty( $src ) || ! is_string( $src ) ) {
+				// @todo replace with `wp_trigger_error()`.
+				_doing_it_wrong(
+					__METHOD__,
+					__( 'Each font src must be a non-empty string.' ),
+					'6.4.0'
+				);
+				return false;
 			}
 		}
 
 		// Check the font-weight.
 		if ( ! is_string( $font_face['font-weight'] ) && ! is_int( $font_face['font-weight'] ) ) {
-			trigger_error( 'Font font-weight must be a properly formatted string or integer.' );
+			// @todo replace with `wp_trigger_error()`.
+			_doing_it_wrong(
+				__METHOD__,
+				__( 'Font font-weight must be a properly formatted string or integer.' ),
+				'6.4.0'
+			);
 			return false;
 		}
 
@@ -200,9 +216,9 @@ private function validate_font_face_properties( array $font_face ) {
 		}
 
 		// Remove invalid properties.
-		foreach ( $font_face as $prop => $value ) {
-			if ( ! in_array( $prop, $this->valid_font_face_properties, true ) ) {
-				unset( $font_face[ $prop ] );
+		foreach ( $font_face as $property => $value ) {
+			if ( ! in_array( $property, $this->valid_font_face_properties, true ) ) {
+				unset( $font_face[ $property ] );
 			}
 		}
 
@@ -210,7 +226,7 @@ private function validate_font_face_properties( array $font_face ) {
 	}
 
 	/**
-	 * Gets the `<style>` element for wrapping the `@font-face` CSS.
+	 * Gets the style element for wrapping the `@font-face` CSS.
 	 *
 	 * @since 6.4.0
 	 *
@@ -253,11 +269,11 @@ private function get_css( $font_faces ) {
 		$css = '';
 
 		foreach ( $font_faces as $font_face ) {
-				// Order the font's `src` items to optimize for browser support.
-				$font_face = $this->order_src( $font_face );
+			// Order the font's `src` items to optimize for browser support.
+			$font_face = $this->order_src( $font_face );
 
-				// Build the @font-face CSS for this font.
-				$css .= '@font-face{' . $this->build_font_face_css( $font_face ) . '}' . "\n";
+			// Build the @font-face CSS for this font.
+			$css .= '@font-face{' . $this->build_font_face_css( $font_face ) . '}' . "\n";
 		}
 
 		// Don't print the last newline character.
@@ -348,8 +364,10 @@ private function order_src( array $font_face ) {
 	private function build_font_face_css( array $font_face ) {
 		$css = '';
 
-		// Wrap font-family in quotes if it contains spaces
-		// and is not already wrapped in quotes.
+		/*
+		 * Wrap font-family in quotes if it contains spaces
+		 * and is not already wrapped in quotes.
+		 */
 		if (
 			str_contains( $font_face['font-family'], ' ' ) &&
 			! str_contains( $font_face['font-family'], '"' ) &&
diff --git a/lib/compat/wordpress-6.4/fonts/fonts.php b/lib/compat/wordpress-6.4/fonts/fonts.php
index ca930141b0c6db..94aef51a440a1e 100644
--- a/lib/compat/wordpress-6.4/fonts/fonts.php
+++ b/lib/compat/wordpress-6.4/fonts/fonts.php
@@ -5,6 +5,8 @@
  * @package    WordPress
  * @subpackage Fonts
  * @since      6.4.0
+ *
+ * @core-merge: this file is located in `wp-includes/fonts.php`. It will contain Font Face and Font Library functions.
  */
 
 if ( ! function_exists( 'wp_print_font_faces' ) ) {
@@ -18,8 +20,31 @@
 	 *
 	 * @since 6.4.0
 	 *
-	 * @param array $fonts Optional. The fonts to generate and print @font-face styles.
-	 *                     Default empty array.
+	 * @param array[][] $fonts {
+	 *     Optional. The font-families and their font variations. Default empty array.
+	 *
+	 *     @type string $font-family => array[] $variations {
+	 *         Optional. An associated array of font variations for this font-family.
+	 *         Each variation has the following structure.
+	 *
+	 *         @type array $font_variation {
+	 *             @type string          $font-family             The font-family property.
+	 *             @type string|string[] $src                     The URL(s) to each resource containing the font data.
+	 *             @type string          $font_style              Optional. The font-style property. Default 'normal'.
+	 *             @type string          $font-weight             Optional. The font-weight property. Default '400'.
+	 *             @type string          $font-display            Optional. The font-display property. Default 'fallback'.
+	 *             @type string          $ascent-override         Optional. The ascent-override property.
+	 *             @type string          $descent-override        Optional. The descent-override property.
+	 *             @type string          $font-stretch            Optional. The font-stretch property.
+	 *             @type string          $font-variant            Optional. The font-variant property.
+	 *             @type string          $font-feature-settings   Optional. The font-feature-settings property.
+	 *             @type string          $font-variation-settings Optional. The font-variation-settings property.
+	 *             @type string          $line-gap-override       Optional. The line-gap-override property.
+	 *             @type string          $size-adjust             Optional. The size-adjust property.
+	 *             @type string          $unicode-range           Optional. The unicode-range property.
+	 *         }
+	 *     }
+	 * }
 	 */
 	function wp_print_font_faces( $fonts = array() ) {
 
diff --git a/phpunit/tests/fonts/font-face/base.php b/phpunit/tests/fonts/font-face/base.php
index 4d6c9cc5cc0325..65d7cdd02d7276 100644
--- a/phpunit/tests/fonts/font-face/base.php
+++ b/phpunit/tests/fonts/font-face/base.php
@@ -10,7 +10,7 @@
 /**
  * Abstracts the common tasks for the Font Face tests.
  */
-abstract class WP_Font_Face_TestCase extends WP_UnitTestCase {
+abstract class WP_Font_Face_UnitTestCase extends WP_UnitTestCase {
 	use WP_Font_Face_Tests_Datasets;
 
 	/**
@@ -62,6 +62,7 @@ public static function set_up_before_class() {
 		parent::set_up_before_class();
 
 		if ( self::$requires_switch_theme_fixtures ) {
+			// @core-merge Use `DIR_TESTDATA` instead of `GUTENBERG_DIR_TESTDATA`.
 			self::$theme_root = realpath( GUTENBERG_DIR_TESTDATA . '/themedir1' );
 		}
 	}
@@ -103,85 +104,33 @@ public function tear_down() {
 		}
 
 		if ( self::$requires_switch_theme_fixtures ) {
-			// Clean up the filters to modify the theme root.
+			$GLOBALS['wp_theme_directories'] = $this->orig_theme_dir;
 			remove_filter( 'theme_root', array( $this, 'filter_set_theme_root' ) );
 			remove_filter( 'stylesheet_root', array( $this, 'filter_set_theme_root' ) );
 			remove_filter( 'template_root', array( $this, 'filter_set_theme_root' ) );
 
-			WP_Theme_JSON_Resolver::clean_cached_data();
-			if ( class_exists( 'WP_Theme_JSON_Resolver_Gutenberg' ) ) {
-				WP_Theme_JSON_Resolver_Gutenberg::clean_cached_data();
-			}
-		}
-
-		parent::tear_down();
-	}
-
-	public function clean_up_global_scope() {
-		parent::clean_up_global_scope();
-
-		if ( self::$requires_switch_theme_fixtures ) {
-			$GLOBALS['wp_theme_directories'] = $this->orig_theme_dir;
 			wp_clean_themes_cache();
-
+			// @core-merge: the function_exists() is not needed in Core.
 			if ( function_exists( 'wp_clean_theme_json_cache' ) ) {
 				wp_clean_theme_json_cache();
 			}
 
+			// @core-merge: start of the plugin only code block. Do not merge into Core.
+			if ( class_exists( 'WP_Theme_JSON_Resolver_Gutenberg' ) ) {
+				WP_Theme_JSON_Resolver_Gutenberg::clean_cached_data();
+			}
 			if ( function_exists( '_gutenberg_clean_theme_json_caches' ) ) {
 				_gutenberg_clean_theme_json_caches();
 			}
+			// @core-merge: end of the plugin only code block.
 
 			unset( $GLOBALS['wp_themes'] );
 		}
+
+		parent::tear_down();
 	}
 
 	public function filter_set_theme_root() {
 		return self::$theme_root;
 	}
-
-	protected function get_reflection_property( $property_name, $class_name = 'WP_Fonts' ) {
-		$property = new ReflectionProperty( $class_name, $property_name );
-		$property->setAccessible( true );
-
-		return $property;
-	}
-
-	protected function get_property_value( $property_name, $class_name, $wp_fonts = null ) {
-		$property = $this->get_reflection_property( $property_name, $class_name );
-
-		if ( ! $wp_fonts ) {
-			$wp_fonts = wp_fonts();
-		}
-
-		return $property->getValue( $wp_fonts );
-	}
-
-	protected function setup_property( $class_name, $property_name ) {
-		$key = $this->get_property_key( $class_name, $property_name );
-
-		if ( ! isset( $this->property[ $key ] ) ) {
-			$this->property[ $key ] = new ReflectionProperty( $class_name, 'providers' );
-			$this->property[ $key ]->setAccessible( true );
-		}
-
-		return $this->property[ $key ];
-	}
-
-	protected function get_property_key( $class_name, $property_name ) {
-		return $class_name . '::$' . $property_name;
-	}
-
-	/**
-	 * Opens the accessibility to access the given private or protected method.
-	 *
-	 * @param string $method_name Name of the method to open.
-	 * @return ReflectionMethod Instance of the method, ie to invoke it in the test.
-	 */
-	protected function get_reflection_method( $method_name ) {
-		$method = new ReflectionMethod( WP_Fonts::class, $method_name );
-		$method->setAccessible( true );
-
-		return $method;
-	}
 }
diff --git a/phpunit/tests/fonts/font-face/wpFontFace/generateAndPrint.php b/phpunit/tests/fonts/font-face/wpFontFace/generateAndPrint.php
index ac68c006ff4d4c..01c00e98a8d38e 100644
--- a/phpunit/tests/fonts/font-face/wpFontFace/generateAndPrint.php
+++ b/phpunit/tests/fonts/font-face/wpFontFace/generateAndPrint.php
@@ -4,19 +4,17 @@
  *
  * @package    WordPress
  * @subpackage Fonts
+ *
+ * @since 6.4.0
  */
 
+// @core-merge this line of code is not needed when merging into Core.
 require_once dirname( __DIR__ ) . '/base.php';
 
 /**
- * Test WP_Font_Face::generate_and_print().
- *
- * @package WordPress
- * @subpackage Fonts
- *
- * @since X.X.X
  * @group fonts
  * @group fontface
+ *
  * @covers WP_Font_Face::generate_and_print
  */
 class Tests_Fonts_WPFontFace_GenerateAndPrint extends WP_UnitTestCase {
diff --git a/phpunit/tests/fonts/font-face/wpFontFaceResolver/getFontsFromThemeJson.php b/phpunit/tests/fonts/font-face/wpFontFaceResolver/getFontsFromThemeJson.php
index 51342b19cafb12..481c451bbafa09 100644
--- a/phpunit/tests/fonts/font-face/wpFontFaceResolver/getFontsFromThemeJson.php
+++ b/phpunit/tests/fonts/font-face/wpFontFaceResolver/getFontsFromThemeJson.php
@@ -4,22 +4,20 @@
  *
  * @package    WordPress
  * @subpackage Fonts
+ *
+ * @since 6.4.0
  */
 
+// @core-merge this line of code is not needed when merging into Core.
 require_once dirname( __DIR__ ) . '/base.php';
 
 /**
- * Tests WP_Font_Face_Resolver::get_fonts_from_theme_json().
- *
- * @package WordPress
- * @subpackage Fonts
- *
- * @since X.X.X
  * @group fonts
  * @group fontface
+ *
  * @covers WP_Font_Face_Resolver::get_fonts_from_theme_json
  */
-class Tests_Fonts_WPFontFaceResolver_GetFontsFromThemeJson extends WP_Font_Face_TestCase {
+class Tests_Fonts_WPFontFaceResolver_GetFontsFromThemeJson extends WP_Font_Face_UnitTestCase {
 	const FONTS_THEME = 'fonts-block-theme';
 
 	public static function set_up_before_class() {
diff --git a/phpunit/tests/fonts/font-face/wpPrintFontFaces.php b/phpunit/tests/fonts/font-face/wpPrintFontFaces.php
index cb3ff2471cc64f..25b02d026e73ea 100644
--- a/phpunit/tests/fonts/font-face/wpPrintFontFaces.php
+++ b/phpunit/tests/fonts/font-face/wpPrintFontFaces.php
@@ -4,22 +4,20 @@
  *
  * @package    WordPress
  * @subpackage Fonts
+ *
+ * @since 6.4.0
  */
 
+// @core-merge this line of code is not needed when merging into Core.
 require_once __DIR__ . '/base.php';
 
 /**
- * Test wp_print_font_faces().
- *
- * @package WordPress
- * @subpackage Fonts
- *
- * @since X.X.X
  * @group fonts
  * @group fontface
+ *
  * @covers wp_print_font_faces
  */
-class Tests_Fonts_WPPrintFontFaces extends WP_Font_Face_TestCase {
+class Tests_Fonts_WpPrintFontFaces extends WP_Font_Face_UnitTestCase {
 	const FONTS_THEME = 'fonts-block-theme';
 
 	public static function set_up_before_class() {
@@ -48,6 +46,30 @@ public function test_should_print_given_fonts( array $fonts, $expected ) {
 		wp_print_font_faces( $fonts );
 	}
 
+	public function test_should_escape_tags() {
+		$fonts = array(
+			'Source Serif Pro' => array(
+				array(
+					'src'          => array( 'http://example.com/assets/source-serif-pro/SourceSerif4Variable-Roman.ttf.woff2' ),
+					'font-family'  => 'Source Serif Pro',
+					'font-style'   => 'normal',
+					'font-weight'  => '200 900',
+					'font-stretch' => '</style><script>console.log("Hello")</script><style>',
+				),
+			),
+		);
+
+		$expected_output = <<<CSS
+<style id='wp-fonts-local' type='text/css'>
+@font-face{font-family:"Source Serif Pro";font-style:normal;font-weight:200 900;font-display:fallback;src:url('http://example.com/assets/source-serif-pro/SourceSerif4Variable-Roman.ttf.woff2') format('woff2');font-stretch:;}
+</style>
+
+CSS;
+		$this->expectOutputString( $expected_output );
+
+		wp_print_font_faces( $fonts );
+	}
+
 	public function test_should_print_fonts_in_merged_data() {
 		switch_theme( static::FONTS_THEME );