wp_get_script_tag() and wp_get_inline_script_tag()

[enricocarraro]

I introduced two new functions that print <script> tags and enable attribute injection:

• wp_print_script_tag and wp_get_script_tag: for script tags that load JavaScript files through the src attribute;
• wp_print_inline_script_tag and wp_get_inline_script_tag: for inline scripts.
  All these functions filter the attributes passed to them through wp_script_attributes so that plugins can change script attributes in a controlled manner.

Instead of directly printing <script> tags, these functions should be used to ensure that every <script> tag is controllable.

Trac ticket: https://core.trac.wordpress.org/ticket/39941

[adamsilverstein]

@enricocarraro Thank you for working on this!

I left a few comments and questions. It would be good explain what the filters do in their inline docs, and also to add a test that covers the wp_get_inline_script_tag action (the test could add add an action and verify it was called with the correct data).

Since this is a bit complex to use it will definitely need a "Dev Note" that explains how the API can be used, including stuff like this: https://github.com/WordPress/wordpress-develop/pull/498/files#r499066268.

Would you say merging this PR fixes https://core.trac.wordpress.org/ticket/39941?

[enricocarraro]

@adamsilverstein thank you for taking the time to look at this.

I left a few comments and questions. It would be good explain what the filters do in their inline docs, and also to add a test that covers the wp_get_inline_script_tag action (the test could add add an action and verify it was called with the correct data).

I will shortly add tests to cover wp_get_inline_script_tag action.

Since this is a bit complex to use it will definitely need a "Dev Note" that explains how the API can be used, including stuff like this: https://github.com/WordPress/wordpress-develop/pull/498/files#r499066268.

Will look into it.

Would you say merging this PR fixes https://core.trac.wordpress.org/ticket/39941?

I wouldn't say so; "allowing a Content-Security-Policy without unsafe-inline" would require all script tags to have a nonce, and not having inline event handlers and javascript: URIs.

[felixarntz]

Looks solid overall, I've added some feedback.

[enricocarraro]

Thanks, @felixarntz.
I made the changes you suggested. Please, let me know if I can do anything else.

[ocean90]

See also https://core.trac.wordpress.org/ticket/39941#comment:60.

[enricocarraro]

Thanks for suggesting the changes @ocean90.
I implemented most of the changes you requested and replied to the comment about combining ifs conditions.

[hellofromtonya]

Closed with changeset https://core.trac.wordpress.org/changeset/50167