Commit inicial - WordPress Análisis de Precios Unitarios

- WordPress core y plugins
- Tema Twenty Twenty-Four configurado
- Plugin allow-unfiltered-html.php simplificado
- .gitignore configurado para excluir wp-config.php y uploads

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

wp-includes/html-api/class-wp-html-active-formatting-elements.php

@@ -0,0 +1,229 @@
+<?php
+/**
+ * HTML API: WP_HTML_Active_Formatting_Elements class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.4.0
+ */
+
+/**
+ * Core class used by the HTML processor during HTML parsing
+ * for managing the stack of active formatting elements.
+ *
+ * This class is designed for internal use by the HTML processor.
+ *
+ * > Initially, the list of active formatting elements is empty.
+ * > It is used to handle mis-nested formatting element tags.
+ * >
+ * > The list contains elements in the formatting category, and markers.
+ * > The markers are inserted when entering applet, object, marquee,
+ * > template, td, th, and caption elements, and are used to prevent
+ * > formatting from "leaking" into applet, object, marquee, template,
+ * > td, th, and caption elements.
+ * >
+ * > In addition, each element in the list of active formatting elements
+ * > is associated with the token for which it was created, so that
+ * > further elements can be created for that token if necessary.
+ *
+ * @since 6.4.0
+ *
+ * @access private
+ *
+ * @see https://html.spec.whatwg.org/#list-of-active-formatting-elements
+ * @see WP_HTML_Processor
+ */
+class WP_HTML_Active_Formatting_Elements {
+	/**
+	 * Holds the stack of active formatting element references.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @var WP_HTML_Token[]
+	 */
+	private $stack = array();
+
+	/**
+	 * Reports if a specific node is in the stack of active formatting elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param WP_HTML_Token $token Look for this node in the stack.
+	 * @return bool Whether the referenced node is in the stack of active formatting elements.
+	 */
+	public function contains_node( WP_HTML_Token $token ) {
+		foreach ( $this->walk_up() as $item ) {
+			if ( $token->bookmark_name === $item->bookmark_name ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Returns how many nodes are currently in the stack of active formatting elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @return int How many node are in the stack of active formatting elements.
+	 */
+	public function count() {
+		return count( $this->stack );
+	}
+
+	/**
+	 * Returns the node at the end of the stack of active formatting elements,
+	 * if one exists. If the stack is empty, returns null.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @return WP_HTML_Token|null Last node in the stack of active formatting elements, if one exists, otherwise null.
+	 */
+	public function current_node() {
+		$current_node = end( $this->stack );
+
+		return $current_node ? $current_node : null;
+	}
+
+	/**
+	 * Inserts a "marker" at the end of the list of active formatting elements.
+	 *
+	 * > The markers are inserted when entering applet, object, marquee,
+	 * > template, td, th, and caption elements, and are used to prevent
+	 * > formatting from "leaking" into applet, object, marquee, template,
+	 * > td, th, and caption elements.
+	 *
+	 * @see https://html.spec.whatwg.org/#concept-parser-marker
+	 *
+	 * @since 6.7.0
+	 */
+	public function insert_marker(): void {
+		$this->push( new WP_HTML_Token( null, 'marker', false ) );
+	}
+
+	/**
+	 * Pushes a node onto the stack of active formatting elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#push-onto-the-list-of-active-formatting-elements
+	 *
+	 * @param WP_HTML_Token $token Push this node onto the stack.
+	 */
+	public function push( WP_HTML_Token $token ) {
+		/*
+		 * > If there are already three elements in the list of active formatting elements after the last marker,
+		 * > if any, or anywhere in the list if there are no markers, that have the same tag name, namespace, and
+		 * > attributes as element, then remove the earliest such element from the list of active formatting
+		 * > elements. For these purposes, the attributes must be compared as they were when the elements were
+		 * > created by the parser; two elements have the same attributes if all their parsed attributes can be
+		 * > paired such that the two attributes in each pair have identical names, namespaces, and values
+		 * > (the order of the attributes does not matter).
+		 *
+		 * @todo Implement the "Noah's Ark clause" to only add up to three of any given kind of formatting elements to the stack.
+		 */
+		// > Add element to the list of active formatting elements.
+		$this->stack[] = $token;
+	}
+
+	/**
+	 * Removes a node from the stack of active formatting elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param WP_HTML_Token $token Remove this node from the stack, if it's there already.
+	 * @return bool Whether the node was found and removed from the stack of active formatting elements.
+	 */
+	public function remove_node( WP_HTML_Token $token ) {
+		foreach ( $this->walk_up() as $position_from_end => $item ) {
+			if ( $token->bookmark_name !== $item->bookmark_name ) {
+				continue;
+			}
+
+			$position_from_start = $this->count() - $position_from_end - 1;
+			array_splice( $this->stack, $position_from_start, 1 );
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * Steps through the stack of active formatting elements, starting with the
+	 * top element (added first) and walking downwards to the one added last.
+	 *
+	 * This generator function is designed to be used inside a "foreach" loop.
+	 *
+	 * Example:
+	 *
+	 *     $html = '<em><strong><a>We are here';
+	 *     foreach ( $stack->walk_down() as $node ) {
+	 *         echo "{$node->node_name} -> ";
+	 *     }
+	 *     > EM -> STRONG -> A ->
+	 *
+	 * To start with the most-recently added element and walk towards the top,
+	 * see WP_HTML_Active_Formatting_Elements::walk_up().
+	 *
+	 * @since 6.4.0
+	 */
+	public function walk_down() {
+		$count = count( $this->stack );
+
+		for ( $i = 0; $i < $count; $i++ ) {
+			yield $this->stack[ $i ];
+		}
+	}
+
+	/**
+	 * Steps through the stack of active formatting elements, starting with the
+	 * bottom element (added last) and walking upwards to the one added first.
+	 *
+	 * This generator function is designed to be used inside a "foreach" loop.
+	 *
+	 * Example:
+	 *
+	 *     $html = '<em><strong><a>We are here';
+	 *     foreach ( $stack->walk_up() as $node ) {
+	 *         echo "{$node->node_name} -> ";
+	 *     }
+	 *     > A -> STRONG -> EM ->
+	 *
+	 * To start with the first added element and walk towards the bottom,
+	 * see WP_HTML_Active_Formatting_Elements::walk_down().
+	 *
+	 * @since 6.4.0
+	 */
+	public function walk_up() {
+		for ( $i = count( $this->stack ) - 1; $i >= 0; $i-- ) {
+			yield $this->stack[ $i ];
+		}
+	}
+
+	/**
+	 * Clears the list of active formatting elements up to the last marker.
+	 *
+	 * > When the steps below require the UA to clear the list of active formatting elements up to
+	 * > the last marker, the UA must perform the following steps:
+	 * >
+	 * > 1. Let entry be the last (most recently added) entry in the list of active
+	 * >    formatting elements.
+	 * > 2. Remove entry from the list of active formatting elements.
+	 * > 3. If entry was a marker, then stop the algorithm at this point.
+	 * >    The list has been cleared up to the last marker.
+	 * > 4. Go to step 1.
+	 *
+	 * @see https://html.spec.whatwg.org/multipage/parsing.html#clear-the-list-of-active-formatting-elements-up-to-the-last-marker
+	 *
+	 * @since 6.7.0
+	 */
+	public function clear_up_to_last_marker(): void {
+		foreach ( $this->walk_up() as $item ) {
+			array_pop( $this->stack );
+			if ( 'marker' === $item->node_name ) {
+				break;
+			}
+		}
+	}
+}

wp-includes/html-api/class-wp-html-attribute-token.php

@@ -0,0 +1,116 @@
+<?php
+/**
+ * HTML API: WP_HTML_Attribute_Token class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.2.0
+ */
+
+/**
+ * Core class used by the HTML tag processor as a data structure for the attribute token,
+ * allowing to drastically improve performance.
+ *
+ * This class is for internal usage of the WP_HTML_Tag_Processor class.
+ *
+ * @access private
+ * @since 6.2.0
+ * @since 6.5.0 Replaced `end` with `length` to more closely match `substr()`.
+ *
+ * @see WP_HTML_Tag_Processor
+ */
+class WP_HTML_Attribute_Token {
+	/**
+	 * Attribute name.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var string
+	 */
+	public $name;
+
+	/**
+	 * Attribute value.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var int
+	 */
+	public $value_starts_at;
+
+	/**
+	 * How many bytes the value occupies in the input HTML.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var int
+	 */
+	public $value_length;
+
+	/**
+	 * The string offset where the attribute name starts.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var int
+	 */
+	public $start;
+
+	/**
+	 * Byte length of text spanning the attribute inside a tag.
+	 *
+	 * This span starts at the first character of the attribute name
+	 * and it ends after one of three cases:
+	 *
+	 *  - at the end of the attribute name for boolean attributes.
+	 *  - at the end of the value for unquoted attributes.
+	 *  - at the final single or double quote for quoted attributes.
+	 *
+	 * Example:
+	 *
+	 *     <div class="post">
+	 *          ------------ length is 12, including quotes
+	 *
+	 *     <input type="checked" checked id="selector">
+	 *                           ------- length is 6
+	 *
+	 *     <a rel=noopener>
+	 *        ------------ length is 11
+	 *
+	 * @since 6.5.0 Replaced `end` with `length` to more closely match `substr()`.
+	 *
+	 * @var int
+	 */
+	public $length;
+
+	/**
+	 * Whether the attribute is a boolean attribute with value `true`.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var bool
+	 */
+	public $is_true;
+
+	/**
+	 * Constructor.
+	 *
+	 * @since 6.2.0
+	 * @since 6.5.0 Replaced `end` with `length` to more closely match `substr()`.
+	 *
+	 * @param string $name         Attribute name.
+	 * @param int    $value_start  Attribute value.
+	 * @param int    $value_length Number of bytes attribute value spans.
+	 * @param int    $start        The string offset where the attribute name starts.
+	 * @param int    $length       Byte length of the entire attribute name or name and value pair expression.
+	 * @param bool   $is_true      Whether the attribute is a boolean attribute with true value.
+	 */
+	public function __construct( $name, $value_start, $value_length, $start, $length, $is_true ) {
+		$this->name            = $name;
+		$this->value_starts_at = $value_start;
+		$this->value_length    = $value_length;
+		$this->start           = $start;
+		$this->length          = $length;
+		$this->is_true         = $is_true;
+	}
+}

wp-includes/html-api/class-wp-html-decoder.php

@@ -0,0 +1,463 @@
+<?php
+
+/**
+ * HTML API: WP_HTML_Decoder class
+ *
+ * Decodes spans of raw text found inside HTML content.
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.6.0
+ */
+class WP_HTML_Decoder {
+	/**
+	 * Indicates if an attribute value starts with a given raw string value.
+	 *
+	 * Use this method to determine if an attribute value starts with a given string, regardless
+	 * of how it might be encoded in HTML. For instance, `http:` could be represented as `http:`
+	 * or as `http&colon;` or as `&#x68;ttp:` or as `h&#116;tp&colon;`, or in many other ways.
+	 *
+	 * Example:
+	 *
+	 *     $value = 'http&colon;//wordpress.org/';
+	 *     true   === WP_HTML_Decoder::attribute_starts_with( $value, 'http:', 'ascii-case-insensitive' );
+	 *     false  === WP_HTML_Decoder::attribute_starts_with( $value, 'https:', 'ascii-case-insensitive' );
+	 *
+	 * @since 6.6.0
+	 *
+	 * @param string $haystack         String containing the raw non-decoded attribute value.
+	 * @param string $search_text      Does the attribute value start with this plain string.
+	 * @param string $case_sensitivity Optional. Pass 'ascii-case-insensitive' to ignore ASCII case when matching.
+	 *                                 Default 'case-sensitive'.
+	 * @return bool Whether the attribute value starts with the given string.
+	 */
+	public static function attribute_starts_with( $haystack, $search_text, $case_sensitivity = 'case-sensitive' ): bool {
+		$search_length = strlen( $search_text );
+		$loose_case    = 'ascii-case-insensitive' === $case_sensitivity;
+		$haystack_end  = strlen( $haystack );
+		$search_at     = 0;
+		$haystack_at   = 0;
+
+		while ( $search_at < $search_length && $haystack_at < $haystack_end ) {
+			$chars_match = $loose_case
+				? strtolower( $haystack[ $haystack_at ] ) === strtolower( $search_text[ $search_at ] )
+				: $haystack[ $haystack_at ] === $search_text[ $search_at ];
+
+			$is_introducer = '&' === $haystack[ $haystack_at ];
+			$next_chunk    = $is_introducer
+				? self::read_character_reference( 'attribute', $haystack, $haystack_at, $token_length )
+				: null;
+
+			// If there's no character reference and the characters don't match, the match fails.
+			if ( null === $next_chunk && ! $chars_match ) {
+				return false;
+			}
+
+			// If there's no character reference but the character do match, then it could still match.
+			if ( null === $next_chunk && $chars_match ) {
+				++$haystack_at;
+				++$search_at;
+				continue;
+			}
+
+			// If there is a character reference, then the decoded value must exactly match what follows in the search string.
+			if ( 0 !== substr_compare( $search_text, $next_chunk, $search_at, strlen( $next_chunk ), $loose_case ) ) {
+				return false;
+			}
+
+			// The character reference matched, so continue checking.
+			$haystack_at += $token_length;
+			$search_at   += strlen( $next_chunk );
+		}
+
+		return true;
+	}
+
+	/**
+	 * Returns a string containing the decoded value of a given HTML text node.
+	 *
+	 * Text nodes appear in HTML DATA sections, which are the text segments inside
+	 * and around tags, excepting SCRIPT and STYLE elements (and some others),
+	 * whose inner text is not decoded. Use this function to read the decoded
+	 * value of such a text span in an HTML document.
+	 *
+	 * Example:
+	 *
+	 *     '“😄”' === WP_HTML_Decode::decode_text_node( '&#x93;&#x1f604;&#x94' );
+	 *
+	 * @since 6.6.0
+	 *
+	 * @param string $text Text containing raw and non-decoded text node to decode.
+	 * @return string Decoded UTF-8 value of given text node.
+	 */
+	public static function decode_text_node( $text ): string {
+		return static::decode( 'data', $text );
+	}
+
+	/**
+	 * Returns a string containing the decoded value of a given HTML attribute.
+	 *
+	 * Text found inside an HTML attribute has different parsing rules than for
+	 * text found inside other markup, or DATA segments. Use this function to
+	 * read the decoded value of an HTML string inside a quoted attribute.
+	 *
+	 * Example:
+	 *
+	 *     '“😄”' === WP_HTML_Decode::decode_attribute( '&#x93;&#x1f604;&#x94' );
+	 *
+	 * @since 6.6.0
+	 *
+	 * @param string $text Text containing raw and non-decoded attribute value to decode.
+	 * @return string Decoded UTF-8 value of given attribute value.
+	 */
+	public static function decode_attribute( $text ): string {
+		return static::decode( 'attribute', $text );
+	}
+
+	/**
+	 * Decodes a span of HTML text, depending on the context in which it's found.
+	 *
+	 * This is a low-level method; prefer calling WP_HTML_Decoder::decode_attribute() or
+	 * WP_HTML_Decoder::decode_text_node() instead. It's provided for cases where this
+	 * may be difficult to do from calling code.
+	 *
+	 * Example:
+	 *
+	 *     '©' = WP_HTML_Decoder::decode( 'data', '&copy;' );
+	 *
+	 * @since 6.6.0
+	 *
+	 * @access private
+	 *
+	 * @param string $context `attribute` for decoding attribute values, `data` otherwise.
+	 * @param string $text    Text document containing span of text to decode.
+	 * @return string Decoded UTF-8 string.
+	 */
+	public static function decode( $context, $text ): string {
+		$decoded = '';
+		$end     = strlen( $text );
+		$at      = 0;
+		$was_at  = 0;
+
+		while ( $at < $end ) {
+			$next_character_reference_at = strpos( $text, '&', $at );
+			if ( false === $next_character_reference_at ) {
+				break;
+			}
+
+			$character_reference = self::read_character_reference( $context, $text, $next_character_reference_at, $token_length );
+			if ( isset( $character_reference ) ) {
+				$at       = $next_character_reference_at;
+				$decoded .= substr( $text, $was_at, $at - $was_at );
+				$decoded .= $character_reference;
+				$at      += $token_length;
+				$was_at   = $at;
+				continue;
+			}
+
+			++$at;
+		}
+
+		if ( 0 === $was_at ) {
+			return $text;
+		}
+
+		if ( $was_at < $end ) {
+			$decoded .= substr( $text, $was_at, $end - $was_at );
+		}
+
+		return $decoded;
+	}
+
+	/**
+	 * Attempt to read a character reference at the given location in a given string,
+	 * depending on the context in which it's found.
+	 *
+	 * If a character reference is found, this function will return the translated value
+	 * that the reference maps to. It will then set `$match_byte_length` the
+	 * number of bytes of input it read while consuming the character reference. This
+	 * gives calling code the opportunity to advance its cursor when traversing a string
+	 * and decoding.
+	 *
+	 * Example:
+	 *
+	 *     null === WP_HTML_Decoder::read_character_reference( 'attribute', 'Ships&hellip;', 0 );
+	 *     '…'  === WP_HTML_Decoder::read_character_reference( 'attribute', 'Ships&hellip;', 5, $token_length );
+	 *     8    === $token_length; // `&hellip;`
+	 *
+	 *     null === WP_HTML_Decoder::read_character_reference( 'attribute', '&notin', 0 );
+	 *     '∉'  === WP_HTML_Decoder::read_character_reference( 'attribute', '&notin;', 0, $token_length );
+	 *     7    === $token_length; // `&notin;`
+	 *
+	 *     '¬'  === WP_HTML_Decoder::read_character_reference( 'data', '&notin', 0, $token_length );
+	 *     4    === $token_length; // `&not`
+	 *     '∉'  === WP_HTML_Decoder::read_character_reference( 'data', '&notin;', 0, $token_length );
+	 *     7    === $token_length; // `&notin;`
+	 *
+	 * @since 6.6.0
+	 *
+	 * @global WP_Token_Map $html5_named_character_references Mappings for HTML5 named character references.
+	 *
+	 * @param string $context            `attribute` for decoding attribute values, `data` otherwise.
+	 * @param string $text               Text document containing span of text to decode.
+	 * @param int    $at                 Optional. Byte offset into text where span begins, defaults to the beginning (0).
+	 * @param int    &$match_byte_length Optional. Set to byte-length of character reference if provided and if a match
+	 *                                   is found, otherwise not set. Default null.
+	 * @return string|false Decoded character reference in UTF-8 if found, otherwise `false`.
+	 */
+	public static function read_character_reference( $context, $text, $at = 0, &$match_byte_length = null ) {
+		/**
+		 * Mappings for HTML5 named character references.
+		 *
+		 * @var WP_Token_Map $html5_named_character_references
+		 */
+		global $html5_named_character_references;
+
+		$length = strlen( $text );
+		if ( $at + 1 >= $length ) {
+			return null;
+		}
+
+		if ( '&' !== $text[ $at ] ) {
+			return null;
+		}
+
+		/*
+		 * Numeric character references.
+		 *
+		 * When truncated, these will encode the code point found by parsing the
+		 * digits that are available. For example, when `&#x1f170;` is truncated
+		 * to `&#x1f1` it will encode `DZ`. It does not:
+		 *  - know how to parse the original `🅰`.
+		 *  - fail to parse and return plaintext `&#x1f1`.
+		 *  - fail to parse and return the replacement character `<60>`
+		 */
+		if ( '#' === $text[ $at + 1 ] ) {
+			if ( $at + 2 >= $length ) {
+				return null;
+			}
+
+			/** Tracks inner parsing within the numeric character reference. */
+			$digits_at = $at + 2;
+
+			if ( 'x' === $text[ $digits_at ] || 'X' === $text[ $digits_at ] ) {
+				$numeric_base   = 16;
+				$numeric_digits = '0123456789abcdefABCDEF';
+				$max_digits     = 6; // &#x10FFFF;
+				++$digits_at;
+			} else {
+				$numeric_base   = 10;
+				$numeric_digits = '0123456789';
+				$max_digits     = 7; // &#1114111;
+			}
+
+			// Cannot encode invalid Unicode code points. Max is to U+10FFFF.
+			$zero_count    = strspn( $text, '0', $digits_at );
+			$digit_count   = strspn( $text, $numeric_digits, $digits_at + $zero_count );
+			$after_digits  = $digits_at + $zero_count + $digit_count;
+			$has_semicolon = $after_digits < $length && ';' === $text[ $after_digits ];
+			$end_of_span   = $has_semicolon ? $after_digits + 1 : $after_digits;
+
+			// `&#` or `&#x` without digits returns into plaintext.
+			if ( 0 === $digit_count && 0 === $zero_count ) {
+				return null;
+			}
+
+			// Whereas `&#` and only zeros is invalid.
+			if ( 0 === $digit_count ) {
+				$match_byte_length = $end_of_span - $at;
+				return '<27>';
+			}
+
+			// If there are too many digits then it's not worth parsing. It's invalid.
+			if ( $digit_count > $max_digits ) {
+				$match_byte_length = $end_of_span - $at;
+				return '<27>';
+			}
+
+			$digits     = substr( $text, $digits_at + $zero_count, $digit_count );
+			$code_point = intval( $digits, $numeric_base );
+
+			/*
+			 * Noncharacters, 0x0D, and non-ASCII-whitespace control characters.
+			 *
+			 * > A noncharacter is a code point that is in the range U+FDD0 to U+FDEF,
+			 * > inclusive, or U+FFFE, U+FFFF, U+1FFFE, U+1FFFF, U+2FFFE, U+2FFFF,
+			 * > U+3FFFE, U+3FFFF, U+4FFFE, U+4FFFF, U+5FFFE, U+5FFFF, U+6FFFE,
+			 * > U+6FFFF, U+7FFFE, U+7FFFF, U+8FFFE, U+8FFFF, U+9FFFE, U+9FFFF,
+			 * > U+AFFFE, U+AFFFF, U+BFFFE, U+BFFFF, U+CFFFE, U+CFFFF, U+DFFFE,
+			 * > U+DFFFF, U+EFFFE, U+EFFFF, U+FFFFE, U+FFFFF, U+10FFFE, or U+10FFFF.
+			 *
+			 * A C0 control is a code point that is in the range of U+00 to U+1F,
+			 * but ASCII whitespace includes U+09, U+0A, U+0C, and U+0D.
+			 *
+			 * These characters are invalid but still decode as any valid character.
+			 * This comment is here to note and explain why there's no check to
+			 * remove these characters or replace them.
+			 *
+			 * @see https://infra.spec.whatwg.org/#noncharacter
+			 */
+
+			/*
+			 * Code points in the C1 controls area need to be remapped as if they
+			 * were stored in Windows-1252. Note! This transformation only happens
+			 * for numeric character references. The raw code points in the byte
+			 * stream are not translated.
+			 *
+			 * > If the number is one of the numbers in the first column of
+			 * > the following table, then find the row with that number in
+			 * > the first column, and set the character reference code to
+			 * > the number in the second column of that row.
+			 */
+			if ( $code_point >= 0x80 && $code_point <= 0x9F ) {
+				$windows_1252_mapping = array(
+					0x20AC, // 0x80 -> EURO SIGN (€).
+					0x81,   // 0x81 -> (no change).
+					0x201A, // 0x82 -> SINGLE LOW-9 QUOTATION MARK (‚).
+					0x0192, // 0x83 -> LATIN SMALL LETTER F WITH HOOK (ƒ).
+					0x201E, // 0x84 -> DOUBLE LOW-9 QUOTATION MARK („).
+					0x2026, // 0x85 -> HORIZONTAL ELLIPSIS (…).
+					0x2020, // 0x86 -> DAGGER (†).
+					0x2021, // 0x87 -> DOUBLE DAGGER (‡).
+					0x02C6, // 0x88 -> MODIFIER LETTER CIRCUMFLEX ACCENT (ˆ).
+					0x2030, // 0x89 -> PER MILLE SIGN (‰).
+					0x0160, // 0x8A -> LATIN CAPITAL LETTER S WITH CARON (Š).
+					0x2039, // 0x8B -> SINGLE LEFT-POINTING ANGLE QUOTATION MARK (‹).
+					0x0152, // 0x8C -> LATIN CAPITAL LIGATURE OE (Œ).
+					0x8D,   // 0x8D -> (no change).
+					0x017D, // 0x8E -> LATIN CAPITAL LETTER Z WITH CARON (Ž).
+					0x8F,   // 0x8F -> (no change).
+					0x90,   // 0x90 -> (no change).
+					0x2018, // 0x91 -> LEFT SINGLE QUOTATION MARK (‘).
+					0x2019, // 0x92 -> RIGHT SINGLE QUOTATION MARK (’).
+					0x201C, // 0x93 -> LEFT DOUBLE QUOTATION MARK (“).
+					0x201D, // 0x94 -> RIGHT DOUBLE QUOTATION MARK (”).
+					0x2022, // 0x95 -> BULLET (•).
+					0x2013, // 0x96 -> EN DASH (–).
+					0x2014, // 0x97 -> EM DASH (—).
+					0x02DC, // 0x98 -> SMALL TILDE (˜).
+					0x2122, // 0x99 -> TRADE MARK SIGN (™).
+					0x0161, // 0x9A -> LATIN SMALL LETTER S WITH CARON (š).
+					0x203A, // 0x9B -> SINGLE RIGHT-POINTING ANGLE QUOTATION MARK (›).
+					0x0153, // 0x9C -> LATIN SMALL LIGATURE OE (œ).
+					0x9D,   // 0x9D -> (no change).
+					0x017E, // 0x9E -> LATIN SMALL LETTER Z WITH CARON (ž).
+					0x0178, // 0x9F -> LATIN CAPITAL LETTER Y WITH DIAERESIS (Ÿ).
+				);
+
+				$code_point = $windows_1252_mapping[ $code_point - 0x80 ];
+			}
+
+			$match_byte_length = $end_of_span - $at;
+			return self::code_point_to_utf8_bytes( $code_point );
+		}
+
+		/** Tracks inner parsing within the named character reference. */
+		$name_at = $at + 1;
+		// Minimum named character reference is two characters. E.g. `GT`.
+		if ( $name_at + 2 > $length ) {
+			return null;
+		}
+
+		$name_length = 0;
+		$replacement = $html5_named_character_references->read_token( $text, $name_at, $name_length );
+		if ( false === $replacement ) {
+			return null;
+		}
+
+		$after_name = $name_at + $name_length;
+
+		// If the match ended with a semicolon then it should always be decoded.
+		if ( ';' === $text[ $name_at + $name_length - 1 ] ) {
+			$match_byte_length = $after_name - $at;
+			return $replacement;
+		}
+
+		/*
+		 * At this point though there's a match for an entry in the named
+		 * character reference table but the match doesn't end in `;`.
+		 * It may be allowed if it's followed by something unambiguous.
+		 */
+		$ambiguous_follower = (
+			$after_name < $length &&
+			$name_at < $length &&
+			(
+				ctype_alnum( $text[ $after_name ] ) ||
+				'=' === $text[ $after_name ]
+			)
+		);
+
+		// It's non-ambiguous, safe to leave it in.
+		if ( ! $ambiguous_follower ) {
+			$match_byte_length = $after_name - $at;
+			return $replacement;
+		}
+
+		// It's ambiguous, which isn't allowed inside attributes.
+		if ( 'attribute' === $context ) {
+			return null;
+		}
+
+		$match_byte_length = $after_name - $at;
+		return $replacement;
+	}
+
+	/**
+	 * Encode a code point number into the UTF-8 encoding.
+	 *
+	 * This encoder implements the UTF-8 encoding algorithm for converting
+	 * a code point into a byte sequence. If it receives an invalid code
+	 * point it will return the Unicode Replacement Character U+FFFD `<60>`.
+	 *
+	 * Example:
+	 *
+	 *     '🅰' === WP_HTML_Decoder::code_point_to_utf8_bytes( 0x1f170 );
+	 *
+	 *     // Half of a surrogate pair is an invalid code point.
+	 *     '<27>' === WP_HTML_Decoder::code_point_to_utf8_bytes( 0xd83c );
+	 *
+	 * @since 6.6.0
+	 *
+	 * @see https://www.rfc-editor.org/rfc/rfc3629 For the UTF-8 standard.
+	 *
+	 * @param int $code_point Which code point to convert.
+	 * @return string Converted code point, or `<60>` if invalid.
+	 */
+	public static function code_point_to_utf8_bytes( $code_point ): string {
+		// Pre-check to ensure a valid code point.
+		if (
+			$code_point <= 0 ||
+			( $code_point >= 0xD800 && $code_point <= 0xDFFF ) ||
+			$code_point > 0x10FFFF
+		) {
+			return '<27>';
+		}
+
+		if ( $code_point <= 0x7F ) {
+			return chr( $code_point );
+		}
+
+		if ( $code_point <= 0x7FF ) {
+			$byte1 = chr( ( $code_point >> 6 ) | 0xC0 );
+			$byte2 = chr( $code_point & 0x3F | 0x80 );
+
+			return "{$byte1}{$byte2}";
+		}
+
+		if ( $code_point <= 0xFFFF ) {
+			$byte1 = chr( ( $code_point >> 12 ) | 0xE0 );
+			$byte2 = chr( ( $code_point >> 6 ) & 0x3F | 0x80 );
+			$byte3 = chr( $code_point & 0x3F | 0x80 );
+
+			return "{$byte1}{$byte2}{$byte3}";
+		}
+
+		// Any values above U+10FFFF are eliminated above in the pre-check.
+		$byte1 = chr( ( $code_point >> 18 ) | 0xF0 );
+		$byte2 = chr( ( $code_point >> 12 ) & 0x3F | 0x80 );
+		$byte3 = chr( ( $code_point >> 6 ) & 0x3F | 0x80 );
+		$byte4 = chr( $code_point & 0x3F | 0x80 );
+
+		return "{$byte1}{$byte2}{$byte3}{$byte4}";
+	}
+}

wp-includes/html-api/class-wp-html-doctype-info.php

@@ -0,0 +1,616 @@
+<?php
+/**
+ * HTML API: WP_HTML_Doctype_Info class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.7.0
+ */
+
+/**
+ * Core class used by the HTML API to represent a DOCTYPE declaration.
+ *
+ * This class parses DOCTYPE tokens for the full parser in the HTML Processor.
+ * Most code interacting with HTML won't need to parse DOCTYPE declarations;
+ * the HTML Processor is one exception. Consult the HTML Processor for proper
+ * parsing of an HTML document.
+ *
+ * A DOCTYPE declaration may indicate its document compatibility mode, which impacts
+ * the structure of the following HTML as well as the behavior of CSS class selectors.
+ * There are three possible modes:
+ *
+ *  - "no-quirks" and "limited-quirks" modes (also called "standards mode").
+ *  - "quirks" mode.
+ *
+ * These modes mostly determine whether CSS class name selectors match values in the
+ * HTML `class` attribute in an ASCII-case-insensitive way (quirks mode), or whether
+ * they match only when byte-for-byte identical (no-quirks mode).
+ *
+ * All HTML documents should start with the standard HTML5 DOCTYPE: `<!DOCTYPE html>`.
+ *
+ * > DOCTYPEs are required for legacy reasons. When omitted, browsers tend to use a different
+ * > rendering mode that is incompatible with some specifications. Including the DOCTYPE in a
+ * > document ensures that the browser makes a best-effort attempt at following the
+ * > relevant specifications.
+ *
+ * @see https://html.spec.whatwg.org/#the-doctype
+ *
+ * DOCTYPE declarations comprise four properties: a name, public identifier, system identifier,
+ * and an indication of which document compatability mode they would imply if an HTML parser
+ * hadn't already determined it from other information.
+ *
+ * @see https://html.spec.whatwg.org/#the-initial-insertion-mode
+ *
+ * Historically, the DOCTYPE declaration was used in SGML documents to instruct a parser how
+ * to interpret the various tags and entities within a document. Its role in HTML diverged
+ * from how it was used in SGML and no meaning should be back-read into HTML based on how it
+ * is used in SGML, XML, or XHTML documents.
+ *
+ * @see https://www.iso.org/standard/16387.html
+ *
+ * @since 6.7.0
+ *
+ * @see WP_HTML_Processor
+ */
+class WP_HTML_Doctype_Info {
+	/**
+	 * Name of the DOCTYPE: should be "html" for HTML documents.
+	 *
+	 * This value should be considered "read only" and not modified.
+	 *
+	 * Historically the DOCTYPE name indicates name of the document's root element.
+	 *
+	 *     <!DOCTYPE html>
+	 *               ╰──┴── name is "html".
+	 *
+	 * @see https://html.spec.whatwg.org/#tokenization
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string|null
+	 */
+	public $name = null;
+
+	/**
+	 * Public identifier of the DOCTYPE.
+	 *
+	 * This value should be considered "read only" and not modified.
+	 *
+	 * The public identifier is optional and should not appear in HTML documents.
+	 * A `null` value indicates that no public identifier was present in the DOCTYPE.
+	 *
+	 * Historically the presence of the public identifier indicated that a document
+	 * was meant to be shared between computer systems and the value indicated to a
+	 * knowledgeable parser how to find the relevant document type definition (DTD).
+	 *
+	 *     <!DOCTYPE html PUBLIC "public id goes here in quotes">
+	 *               │  │         ╰─── public identifier ─────╯
+	 *               ╰──┴── name is "html".
+	 *
+	 * @see https://html.spec.whatwg.org/#tokenization
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string|null
+	 */
+	public $public_identifier = null;
+
+	/**
+	 * System identifier of the DOCTYPE.
+	 *
+	 * This value should be considered "read only" and not modified.
+	 *
+	 * The system identifier is optional and should not appear in HTML documents.
+	 * A `null` value indicates that no system identifier was present in the DOCTYPE.
+	 *
+	 * Historically the system identifier specified where a relevant document type
+	 * declaration for the given document is stored and may be retrieved.
+	 *
+	 *     <!DOCTYPE html SYSTEM "system id goes here in quotes">
+	 *               │  │         ╰──── system identifier ────╯
+	 *               ╰──┴── name is "html".
+	 *
+	 * If a public identifier were provided it would indicate to a knowledgeable
+	 * parser how to interpret the system identifier.
+	 *
+	 *     <!DOCTYPE html PUBLIC "public id goes here in quotes" "system id goes here in quotes">
+	 *               │  │         ╰─── public identifier ─────╯   ╰──── system identifier ────╯
+	 *               ╰──┴── name is "html".
+	 *
+	 * @see https://html.spec.whatwg.org/#tokenization
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string|null
+	 */
+	public $system_identifier = null;
+
+	/**
+	 * Which document compatability mode this DOCTYPE declaration indicates.
+	 *
+	 * This value should be considered "read only" and not modified.
+	 *
+	 * When an HTML parser has not already set the document compatability mode,
+	 * (e.g. "quirks" or "no-quirks" mode), it will infer if from the properties
+	 * of the appropriate DOCTYPE declaration, if one exists. The DOCTYPE can
+	 * indicate one of three possible document compatability modes:
+	 *
+	 *  - "no-quirks" and "limited-quirks" modes (also called "standards" mode).
+	 *  - "quirks" mode (also called `CSS1Compat` mode).
+	 *
+	 * An appropriate DOCTYPE is one encountered in the "initial" insertion mode,
+	 * before the HTML element has been opened and before finding any other
+	 * DOCTYPE declaration tokens.
+	 *
+	 * @see https://html.spec.whatwg.org/#the-initial-insertion-mode
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string One of "no-quirks", "limited-quirks", or "quirks".
+	 */
+	public $indicated_compatability_mode;
+
+	/**
+	 * Constructor.
+	 *
+	 * This class should not be instantiated directly.
+	 * Use the static {@see self::from_doctype_token} method instead.
+	 *
+	 * The arguments to this constructor correspond to the "DOCTYPE token"
+	 * as defined in the HTML specification.
+	 *
+	 * > DOCTYPE tokens have a name, a public identifier, a system identifier,
+	 * > and a force-quirks flag. When a DOCTYPE token is created, its name, public identifier,
+	 * > and system identifier must be marked as missing (which is a distinct state from the
+	 * > empty string), and the force-quirks flag must be set to off (its other state is on).
+	 *
+	 * @see https://html.spec.whatwg.org/multipage/parsing.html#tokenization
+	 *
+	 * @since 6.7.0
+	 *
+	 * @param string|null $name              Name of the DOCTYPE.
+	 * @param string|null $public_identifier Public identifier of the DOCTYPE.
+	 * @param string|null $system_identifier System identifier of the DOCTYPE.
+	 * @param bool        $force_quirks_flag Whether the force-quirks flag is set for the token.
+	 */
+	private function __construct(
+		?string $name,
+		?string $public_identifier,
+		?string $system_identifier,
+		bool $force_quirks_flag
+	) {
+		$this->name              = $name;
+		$this->public_identifier = $public_identifier;
+		$this->system_identifier = $system_identifier;
+
+		/*
+		 * > If the DOCTYPE token matches one of the conditions in the following list,
+		 * > then set the Document to quirks mode:
+		 */
+
+		/*
+		 * > The force-quirks flag is set to on.
+		 */
+		if ( $force_quirks_flag ) {
+			$this->indicated_compatability_mode = 'quirks';
+			return;
+		}
+
+		/*
+		 * Normative documents will contain the literal `<!DOCTYPE html>` with no
+		 * public or system identifiers; short-circuit to avoid extra parsing.
+		 */
+		if ( 'html' === $name && null === $public_identifier && null === $system_identifier ) {
+			$this->indicated_compatability_mode = 'no-quirks';
+			return;
+		}
+
+		/*
+		 * > The name is not "html".
+		 *
+		 * The tokenizer must report the name in lower case even if provided in
+		 * the document in upper case; thus no conversion is required here.
+		 */
+		if ( 'html' !== $name ) {
+			$this->indicated_compatability_mode = 'quirks';
+			return;
+		}
+
+		/*
+		 * Set up some variables to handle the rest of the conditions.
+		 *
+		 * > set...the public identifier...to...the empty string if the public identifier was missing.
+		 * > set...the system identifier...to...the empty string if the system identifier was missing.
+		 * >
+		 * > The system identifier and public identifier strings must be compared...
+		 * > in an ASCII case-insensitive manner.
+		 * >
+		 * > A system identifier whose value is the empty string is not considered missing
+		 * > for the purposes of the conditions above.
+		 */
+		$system_identifier_is_missing = null === $system_identifier;
+		$public_identifier            = null === $public_identifier ? '' : strtolower( $public_identifier );
+		$system_identifier            = null === $system_identifier ? '' : strtolower( $system_identifier );
+
+		/*
+		 * > The public identifier is set to…
+		 */
+		if (
+			'-//w3o//dtd w3 html strict 3.0//en//' === $public_identifier ||
+			'-/w3c/dtd html 4.0 transitional/en' === $public_identifier ||
+			'html' === $public_identifier
+		) {
+			$this->indicated_compatability_mode = 'quirks';
+			return;
+		}
+
+		/*
+		 * > The system identifier is set to…
+		 */
+		if ( 'http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd' === $system_identifier ) {
+			$this->indicated_compatability_mode = 'quirks';
+			return;
+		}
+
+		/*
+		 * All of the following conditions depend on matching the public identifier.
+		 * If the public identifier is empty, none of the following conditions will match.
+		 */
+		if ( '' === $public_identifier ) {
+			$this->indicated_compatability_mode = 'no-quirks';
+			return;
+		}
+
+		/*
+		 * > The public identifier starts with…
+		 *
+		 * @todo Optimize this matching. It shouldn't be a large overall performance issue,
+		 *       however, as only a single DOCTYPE declaration token should ever be parsed,
+		 *       and normative documents will have exited before reaching this condition.
+		 */
+		if (
+			str_starts_with( $public_identifier, '+//silmaril//dtd html pro v0r11 19970101//' ) ||
+			str_starts_with( $public_identifier, '-//as//dtd html 3.0 aswedit + extensions//' ) ||
+			str_starts_with( $public_identifier, '-//advasoft ltd//dtd html 3.0 aswedit + extensions//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 2.0 level 1//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 2.0 level 2//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 2.0 strict level 1//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 2.0 strict level 2//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 2.0 strict//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 2.0//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 2.1e//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 3.0//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 3.2 final//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 3.2//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html 3//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html level 0//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html level 1//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html level 2//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html level 3//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html strict level 0//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html strict level 1//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html strict level 2//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html strict level 3//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html strict//' ) ||
+			str_starts_with( $public_identifier, '-//ietf//dtd html//' ) ||
+			str_starts_with( $public_identifier, '-//metrius//dtd metrius presentational//' ) ||
+			str_starts_with( $public_identifier, '-//microsoft//dtd internet explorer 2.0 html strict//' ) ||
+			str_starts_with( $public_identifier, '-//microsoft//dtd internet explorer 2.0 html//' ) ||
+			str_starts_with( $public_identifier, '-//microsoft//dtd internet explorer 2.0 tables//' ) ||
+			str_starts_with( $public_identifier, '-//microsoft//dtd internet explorer 3.0 html strict//' ) ||
+			str_starts_with( $public_identifier, '-//microsoft//dtd internet explorer 3.0 html//' ) ||
+			str_starts_with( $public_identifier, '-//microsoft//dtd internet explorer 3.0 tables//' ) ||
+			str_starts_with( $public_identifier, '-//netscape comm. corp.//dtd html//' ) ||
+			str_starts_with( $public_identifier, '-//netscape comm. corp.//dtd strict html//' ) ||
+			str_starts_with( $public_identifier, "-//o'reilly and associates//dtd html 2.0//" ) ||
+			str_starts_with( $public_identifier, "-//o'reilly and associates//dtd html extended 1.0//" ) ||
+			str_starts_with( $public_identifier, "-//o'reilly and associates//dtd html extended relaxed 1.0//" ) ||
+			str_starts_with( $public_identifier, '-//sq//dtd html 2.0 hotmetal + extensions//' ) ||
+			str_starts_with( $public_identifier, '-//softquad software//dtd hotmetal pro 6.0::19990601::extensions to html 4.0//' ) ||
+			str_starts_with( $public_identifier, '-//softquad//dtd hotmetal pro 4.0::19971010::extensions to html 4.0//' ) ||
+			str_starts_with( $public_identifier, '-//spyglass//dtd html 2.0 extended//' ) ||
+			str_starts_with( $public_identifier, '-//sun microsystems corp.//dtd hotjava html//' ) ||
+			str_starts_with( $public_identifier, '-//sun microsystems corp.//dtd hotjava strict html//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html 3 1995-03-24//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html 3.2 draft//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html 3.2 final//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html 3.2//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html 3.2s draft//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html 4.0 frameset//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html 4.0 transitional//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html experimental 19960712//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd html experimental 970421//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd w3 html//' ) ||
+			str_starts_with( $public_identifier, '-//w3o//dtd w3 html 3.0//' ) ||
+			str_starts_with( $public_identifier, '-//webtechs//dtd mozilla html 2.0//' ) ||
+			str_starts_with( $public_identifier, '-//webtechs//dtd mozilla html//' )
+		) {
+			$this->indicated_compatability_mode = 'quirks';
+			return;
+		}
+
+		/*
+		 * > The system identifier is missing and the public identifier starts with…
+		 */
+		if (
+			$system_identifier_is_missing && (
+				str_starts_with( $public_identifier, '-//w3c//dtd html 4.01 frameset//' ) ||
+				str_starts_with( $public_identifier, '-//w3c//dtd html 4.01 transitional//' )
+			)
+		) {
+			$this->indicated_compatability_mode = 'quirks';
+			return;
+		}
+
+		/*
+		 * > Otherwise, if the DOCTYPE token matches one of the conditions in
+		 * > the following list, then set the Document to limited-quirks mode.
+		 */
+
+		/*
+		 * > The public identifier starts with…
+		 */
+		if (
+			str_starts_with( $public_identifier, '-//w3c//dtd xhtml 1.0 frameset//' ) ||
+			str_starts_with( $public_identifier, '-//w3c//dtd xhtml 1.0 transitional//' )
+		) {
+			$this->indicated_compatability_mode = 'limited-quirks';
+			return;
+		}
+
+		/*
+		 * > The system identifier is not missing and the public identifier starts with…
+		 */
+		if (
+			! $system_identifier_is_missing && (
+				str_starts_with( $public_identifier, '-//w3c//dtd html 4.01 frameset//' ) ||
+				str_starts_with( $public_identifier, '-//w3c//dtd html 4.01 transitional//' )
+			)
+		) {
+			$this->indicated_compatability_mode = 'limited-quirks';
+			return;
+		}
+
+		$this->indicated_compatability_mode = 'no-quirks';
+	}
+
+	/**
+	 * Creates a WP_HTML_Doctype_Info instance by parsing a raw DOCTYPE declaration token.
+	 *
+	 * Use this method to parse a DOCTYPE declaration token and get access to its properties
+	 * via the returned WP_HTML_Doctype_Info class instance. The provided input must parse
+	 * properly as a DOCTYPE declaration, though it must not represent a valid DOCTYPE.
+	 *
+	 * Example:
+	 *
+	 *     // Normative HTML DOCTYPE declaration.
+	 *     $doctype = WP_HTML_Doctype_Info::from_doctype_token( '<!DOCTYPE html>' );
+	 *     'no-quirks' === $doctype->indicated_compatability_mode;
+	 *
+	 *     // A nonsensical DOCTYPE is still valid, and will indicate "quirks" mode.
+	 *     $doctype = WP_HTML_Doctype_Info::from_doctype_token( '<!doctypeJSON SILLY "nonsense\'>' );
+	 *     'quirks' === $doctype->indicated_compatability_mode;
+	 *
+	 *     // Textual quirks present in raw HTML are handled appropriately.
+	 *     $doctype = WP_HTML_Doctype_Info::from_doctype_token( "<!DOCTYPE\nhtml\n>" );
+	 *     'no-quirks' === $doctype->indicated_compatability_mode;
+	 *
+	 *     // Anything other than a proper DOCTYPE declaration token fails to parse.
+	 *     null === WP_HTML_Doctype_Info::from_doctype_token( ' <!DOCTYPE>' );
+	 *     null === WP_HTML_Doctype_Info::from_doctype_token( '<!DOCTYPE ><p>' );
+	 *     null === WP_HTML_Doctype_Info::from_doctype_token( '<!TYPEDOC>' );
+	 *     null === WP_HTML_Doctype_Info::from_doctype_token( 'html' );
+	 *     null === WP_HTML_Doctype_Info::from_doctype_token( '<?xml version="1.0" encoding="UTF-8" ?>' );
+	 *
+	 * @since 6.7.0
+	 *
+	 * @param string $doctype_html The complete raw DOCTYPE HTML string, e.g. `<!DOCTYPE html>`.
+	 *
+	 * @return WP_HTML_Doctype_Info|null A WP_HTML_Doctype_Info instance will be returned if the
+	 *                                   provided DOCTYPE HTML is a valid DOCTYPE. Otherwise, null.
+	 */
+	public static function from_doctype_token( string $doctype_html ): ?self {
+		$doctype_name      = null;
+		$doctype_public_id = null;
+		$doctype_system_id = null;
+
+		$end = strlen( $doctype_html ) - 1;
+
+		/*
+		 * This parser combines the rules for parsing DOCTYPE tokens found in the HTML
+		 * specification for the DOCTYPE related tokenizer states.
+		 *
+		 * @see https://html.spec.whatwg.org/#doctype-state
+		 */
+
+		/*
+		 * - Valid DOCTYPE HTML token must be at least `<!DOCTYPE>` assuming a complete token not
+		 *   ending in end-of-file.
+		 * - It must start with an ASCII case-insensitive match for `<!DOCTYPE`.
+		 * - The only occurrence of `>` must be the final byte in the HTML string.
+		 */
+		if (
+			$end < 9 ||
+			0 !== substr_compare( $doctype_html, '<!DOCTYPE', 0, 9, true )
+		) {
+			return null;
+		}
+
+		$at = 9;
+		// Is there one and only one `>`?
+		if ( '>' !== $doctype_html[ $end ] || ( strcspn( $doctype_html, '>', $at ) + $at ) < $end ) {
+			return null;
+		}
+
+		/*
+		 * Perform newline normalization and ensure the $end value is correct after normalization.
+		 *
+		 * @see https://html.spec.whatwg.org/#preprocessing-the-input-stream
+		 * @see https://infra.spec.whatwg.org/#normalize-newlines
+		 */
+		$doctype_html = str_replace( "\r\n", "\n", $doctype_html );
+		$doctype_html = str_replace( "\r", "\n", $doctype_html );
+		$end          = strlen( $doctype_html ) - 1;
+
+		/*
+		 * In this state, the doctype token has been found and its "content" optionally including the
+		 * name, public identifier, and system identifier is between the current position and the end.
+		 *
+		 *     "<!DOCTYPE...declaration...>"
+		 *               ╰─ $at           ╰─ $end
+		 *
+		 * It's also possible that the declaration part is empty.
+		 *
+		 *               ╭─ $at
+		 *     "<!DOCTYPE>"
+		 *               ╰─ $end
+		 *
+		 * Rules for parsing ">" which terminates the DOCTYPE do not need to be considered as they
+		 * have been handled above in the condition that the provided DOCTYPE HTML must contain
+		 * exactly one ">" character in the final position.
+		 */
+
+		/*
+		 *
+		 * Parsing effectively begins in "Before DOCTYPE name state". Ignore whitespace and
+		 * proceed to the next state.
+		 *
+		 * @see https://html.spec.whatwg.org/#before-doctype-name-state
+		 */
+		$at += strspn( $doctype_html, " \t\n\f\r", $at );
+
+		if ( $at >= $end ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+		}
+
+		$name_length  = strcspn( $doctype_html, " \t\n\f\r", $at, $end - $at );
+		$doctype_name = str_replace( "\0", "\u{FFFD}", strtolower( substr( $doctype_html, $at, $name_length ) ) );
+
+		$at += $name_length;
+		$at += strspn( $doctype_html, " \t\n\f\r", $at, $end - $at );
+		if ( $at >= $end ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, false );
+		}
+
+		/*
+		 * "After DOCTYPE name state"
+		 *
+		 * Find a case-insensitive match for "PUBLIC" or "SYSTEM" at this point.
+		 * Otherwise, set force-quirks and enter bogus DOCTYPE state (skip the rest of the doctype).
+		 *
+		 * @see https://html.spec.whatwg.org/#after-doctype-name-state
+		 */
+		if ( $at + 6 >= $end ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+		}
+
+		/*
+		 * > If the six characters starting from the current input character are an ASCII
+		 * > case-insensitive match for the word "PUBLIC", then consume those characters
+		 * > and switch to the after DOCTYPE public keyword state.
+		 */
+		if ( 0 === substr_compare( $doctype_html, 'PUBLIC', $at, 6, true ) ) {
+			$at += 6;
+			$at += strspn( $doctype_html, " \t\n\f\r", $at, $end - $at );
+			if ( $at >= $end ) {
+				return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+			}
+			goto parse_doctype_public_identifier;
+		}
+
+		/*
+		 * > Otherwise, if the six characters starting from the current input character are an ASCII
+		 * > case-insensitive match for the word "SYSTEM", then consume those characters and switch
+		 * > to the after DOCTYPE system keyword state.
+		 */
+		if ( 0 === substr_compare( $doctype_html, 'SYSTEM', $at, 6, true ) ) {
+			$at += 6;
+			$at += strspn( $doctype_html, " \t\n\f\r", $at, $end - $at );
+			if ( $at >= $end ) {
+				return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+			}
+			goto parse_doctype_system_identifier;
+		}
+
+		/*
+		 * > Otherwise, this is an invalid-character-sequence-after-doctype-name parse error.
+		 * > Set the current DOCTYPE token's force-quirks flag to on. Reconsume in the bogus
+		 * > DOCTYPE state.
+		 */
+		return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+
+		parse_doctype_public_identifier:
+		/*
+		 * The parser should enter "DOCTYPE public identifier (double-quoted) state" or
+		 * "DOCTYPE public identifier (single-quoted) state" by finding one of the valid quotes.
+		 * Anything else forces quirks mode and ignores the rest of the contents.
+		 *
+		 * @see https://html.spec.whatwg.org/#doctype-public-identifier-(double-quoted)-state
+		 * @see https://html.spec.whatwg.org/#doctype-public-identifier-(single-quoted)-state
+		 */
+		$closer_quote = $doctype_html[ $at ];
+
+		/*
+		 * > This is a missing-quote-before-doctype-public-identifier parse error. Set the
+		 * > current DOCTYPE token's force-quirks flag to on. Reconsume in the bogus DOCTYPE state.
+		 */
+		if ( '"' !== $closer_quote && "'" !== $closer_quote ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+		}
+
+		++$at;
+
+		$identifier_length = strcspn( $doctype_html, $closer_quote, $at, $end - $at );
+		$doctype_public_id = str_replace( "\0", "\u{FFFD}", substr( $doctype_html, $at, $identifier_length ) );
+
+		$at += $identifier_length;
+		if ( $at >= $end || $closer_quote !== $doctype_html[ $at ] ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+		}
+
+		++$at;
+
+		/*
+		 * "Between DOCTYPE public and system identifiers state"
+		 *
+		 * Advance through whitespace between public and system identifiers.
+		 *
+		 * @see https://html.spec.whatwg.org/#between-doctype-public-and-system-identifiers-state
+		 */
+		$at += strspn( $doctype_html, " \t\n\f\r", $at, $end - $at );
+		if ( $at >= $end ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, false );
+		}
+
+		parse_doctype_system_identifier:
+		/*
+		 * The parser should enter "DOCTYPE system identifier (double-quoted) state" or
+		 * "DOCTYPE system identifier (single-quoted) state" by finding one of the valid quotes.
+		 * Anything else forces quirks mode and ignores the rest of the contents.
+		 *
+		 * @see https://html.spec.whatwg.org/#doctype-system-identifier-(double-quoted)-state
+		 * @see https://html.spec.whatwg.org/#doctype-system-identifier-(single-quoted)-state
+		 */
+		$closer_quote = $doctype_html[ $at ];
+
+		/*
+		 * > This is a missing-quote-before-doctype-system-identifier parse error. Set the
+		 * > current DOCTYPE token's force-quirks flag to on. Reconsume in the bogus DOCTYPE state.
+		 */
+		if ( '"' !== $closer_quote && "'" !== $closer_quote ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+		}
+
+		++$at;
+
+		$identifier_length = strcspn( $doctype_html, $closer_quote, $at, $end - $at );
+		$doctype_system_id = str_replace( "\0", "\u{FFFD}", substr( $doctype_html, $at, $identifier_length ) );
+
+		$at += $identifier_length;
+		if ( $at >= $end || $closer_quote !== $doctype_html[ $at ] ) {
+			return new self( $doctype_name, $doctype_public_id, $doctype_system_id, true );
+		}
+
+		return new self( $doctype_name, $doctype_public_id, $doctype_system_id, false );
+	}
+}

wp-includes/html-api/class-wp-html-open-elements.php

@@ -0,0 +1,852 @@
+<?php
+/**
+ * HTML API: WP_HTML_Open_Elements class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.4.0
+ */
+
+/**
+ * Core class used by the HTML processor during HTML parsing
+ * for managing the stack of open elements.
+ *
+ * This class is designed for internal use by the HTML processor.
+ *
+ * > Initially, the stack of open elements is empty. The stack grows
+ * > downwards; the topmost node on the stack is the first one added
+ * > to the stack, and the bottommost node of the stack is the most
+ * > recently added node in the stack (notwithstanding when the stack
+ * > is manipulated in a random access fashion as part of the handling
+ * > for misnested tags).
+ *
+ * @since 6.4.0
+ *
+ * @access private
+ *
+ * @see https://html.spec.whatwg.org/#stack-of-open-elements
+ * @see WP_HTML_Processor
+ */
+class WP_HTML_Open_Elements {
+	/**
+	 * Holds the stack of open element references.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @var WP_HTML_Token[]
+	 */
+	public $stack = array();
+
+	/**
+	 * Whether a P element is in button scope currently.
+	 *
+	 * This class optimizes scope lookup by pre-calculating
+	 * this value when elements are added and removed to the
+	 * stack of open elements which might change its value.
+	 * This avoids frequent iteration over the stack.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @var bool
+	 */
+	private $has_p_in_button_scope = false;
+
+	/**
+	 * A function that will be called when an item is popped off the stack of open elements.
+	 *
+	 * The function will be called with the popped item as its argument.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @var Closure|null
+	 */
+	private $pop_handler = null;
+
+	/**
+	 * A function that will be called when an item is pushed onto the stack of open elements.
+	 *
+	 * The function will be called with the pushed item as its argument.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @var Closure|null
+	 */
+	private $push_handler = null;
+
+	/**
+	 * Sets a pop handler that will be called when an item is popped off the stack of
+	 * open elements.
+	 *
+	 * The function will be called with the pushed item as its argument.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @param Closure $handler The handler function.
+	 */
+	public function set_pop_handler( Closure $handler ): void {
+		$this->pop_handler = $handler;
+	}
+
+	/**
+	 * Sets a push handler that will be called when an item is pushed onto the stack of
+	 * open elements.
+	 *
+	 * The function will be called with the pushed item as its argument.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @param Closure $handler The handler function.
+	 */
+	public function set_push_handler( Closure $handler ): void {
+		$this->push_handler = $handler;
+	}
+
+	/**
+	 * Returns the name of the node at the nth position on the stack
+	 * of open elements, or `null` if no such position exists.
+	 *
+	 * Note that this uses a 1-based index, which represents the
+	 * "nth item" on the stack, counting from the top, where the
+	 * top-most element is the 1st, the second is the 2nd, etc...
+	 *
+	 * @since 6.7.0
+	 *
+	 * @param int $nth Retrieve the nth item on the stack, with 1 being
+	 *                 the top element, 2 being the second, etc...
+	 * @return WP_HTML_Token|null Name of the node on the stack at the given location,
+	 *                            or `null` if the location isn't on the stack.
+	 */
+	public function at( int $nth ): ?WP_HTML_Token {
+		foreach ( $this->walk_down() as $item ) {
+			if ( 0 === --$nth ) {
+				return $item;
+			}
+		}
+
+		return null;
+	}
+
+	/**
+	 * Reports if a node of a given name is in the stack of open elements.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @param string $node_name Name of node for which to check.
+	 * @return bool Whether a node of the given name is in the stack of open elements.
+	 */
+	public function contains( string $node_name ): bool {
+		foreach ( $this->walk_up() as $item ) {
+			if ( $node_name === $item->node_name ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Reports if a specific node is in the stack of open elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param WP_HTML_Token $token Look for this node in the stack.
+	 * @return bool Whether the referenced node is in the stack of open elements.
+	 */
+	public function contains_node( WP_HTML_Token $token ): bool {
+		foreach ( $this->walk_up() as $item ) {
+			if ( $token === $item ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Returns how many nodes are currently in the stack of open elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @return int How many node are in the stack of open elements.
+	 */
+	public function count(): int {
+		return count( $this->stack );
+	}
+
+	/**
+	 * Returns the node at the end of the stack of open elements,
+	 * if one exists. If the stack is empty, returns null.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @return WP_HTML_Token|null Last node in the stack of open elements, if one exists, otherwise null.
+	 */
+	public function current_node(): ?WP_HTML_Token {
+		$current_node = end( $this->stack );
+
+		return $current_node ? $current_node : null;
+	}
+
+	/**
+	 * Indicates if the current node is of a given type or name.
+	 *
+	 * It's possible to pass either a node type or a node name to this function.
+	 * In the case there is no current element it will always return `false`.
+	 *
+	 * Example:
+	 *
+	 *     // Is the current node a text node?
+	 *     $stack->current_node_is( '#text' );
+	 *
+	 *     // Is the current node a DIV element?
+	 *     $stack->current_node_is( 'DIV' );
+	 *
+	 *     // Is the current node any element/tag?
+	 *     $stack->current_node_is( '#tag' );
+	 *
+	 * @see WP_HTML_Tag_Processor::get_token_type
+	 * @see WP_HTML_Tag_Processor::get_token_name
+	 *
+	 * @since 6.7.0
+	 *
+	 * @access private
+	 *
+	 * @param string $identity Check if the current node has this name or type (depending on what is provided).
+	 * @return bool Whether there is a current element that matches the given identity, whether a token name or type.
+	 */
+	public function current_node_is( string $identity ): bool {
+		$current_node = end( $this->stack );
+		if ( false === $current_node ) {
+			return false;
+		}
+
+		$current_node_name = $current_node->node_name;
+
+		return (
+			$current_node_name === $identity ||
+			( '#doctype' === $identity && 'html' === $current_node_name ) ||
+			( '#tag' === $identity && ctype_upper( $current_node_name ) )
+		);
+	}
+
+	/**
+	 * Returns whether an element is in a specific scope.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#has-an-element-in-the-specific-scope
+	 *
+	 * @param string   $tag_name         Name of tag check.
+	 * @param string[] $termination_list List of elements that terminate the search.
+	 * @return bool Whether the element was found in a specific scope.
+	 */
+	public function has_element_in_specific_scope( string $tag_name, $termination_list ): bool {
+		foreach ( $this->walk_up() as $node ) {
+			$namespaced_name = 'html' === $node->namespace
+				? $node->node_name
+				: "{$node->namespace} {$node->node_name}";
+
+			if ( $namespaced_name === $tag_name ) {
+				return true;
+			}
+
+			if (
+				'(internal: H1 through H6 - do not use)' === $tag_name &&
+				in_array( $namespaced_name, array( 'H1', 'H2', 'H3', 'H4', 'H5', 'H6' ), true )
+			) {
+				return true;
+			}
+
+			if ( in_array( $namespaced_name, $termination_list, true ) ) {
+				return false;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Returns whether a particular element is in scope.
+	 *
+	 * > The stack of open elements is said to have a particular element in
+	 * > scope when it has that element in the specific scope consisting of
+	 * > the following element types:
+	 * >
+	 * >   - applet
+	 * >   - caption
+	 * >   - html
+	 * >   - table
+	 * >   - td
+	 * >   - th
+	 * >   - marquee
+	 * >   - object
+	 * >   - template
+	 * >   - MathML mi
+	 * >   - MathML mo
+	 * >   - MathML mn
+	 * >   - MathML ms
+	 * >   - MathML mtext
+	 * >   - MathML annotation-xml
+	 * >   - SVG foreignObject
+	 * >   - SVG desc
+	 * >   - SVG title
+	 *
+	 * @since 6.4.0
+	 * @since 6.7.0 Full support.
+	 *
+	 * @see https://html.spec.whatwg.org/#has-an-element-in-scope
+	 *
+	 * @param string $tag_name Name of tag to check.
+	 * @return bool Whether given element is in scope.
+	 */
+	public function has_element_in_scope( string $tag_name ): bool {
+		return $this->has_element_in_specific_scope(
+			$tag_name,
+			array(
+				'APPLET',
+				'CAPTION',
+				'HTML',
+				'TABLE',
+				'TD',
+				'TH',
+				'MARQUEE',
+				'OBJECT',
+				'TEMPLATE',
+
+				'math MI',
+				'math MO',
+				'math MN',
+				'math MS',
+				'math MTEXT',
+				'math ANNOTATION-XML',
+
+				'svg FOREIGNOBJECT',
+				'svg DESC',
+				'svg TITLE',
+			)
+		);
+	}
+
+	/**
+	 * Returns whether a particular element is in list item scope.
+	 *
+	 * > The stack of open elements is said to have a particular element
+	 * > in list item scope when it has that element in the specific scope
+	 * > consisting of the following element types:
+	 * >
+	 * >   - All the element types listed above for the has an element in scope algorithm.
+	 * >   - ol in the HTML namespace
+	 * >   - ul in the HTML namespace
+	 *
+	 * @since 6.4.0
+	 * @since 6.5.0 Implemented: no longer throws on every invocation.
+	 * @since 6.7.0 Supports all required HTML elements.
+	 *
+	 * @see https://html.spec.whatwg.org/#has-an-element-in-list-item-scope
+	 *
+	 * @param string $tag_name Name of tag to check.
+	 * @return bool Whether given element is in scope.
+	 */
+	public function has_element_in_list_item_scope( string $tag_name ): bool {
+		return $this->has_element_in_specific_scope(
+			$tag_name,
+			array(
+				'APPLET',
+				'BUTTON',
+				'CAPTION',
+				'HTML',
+				'TABLE',
+				'TD',
+				'TH',
+				'MARQUEE',
+				'OBJECT',
+				'OL',
+				'TEMPLATE',
+				'UL',
+
+				'math MI',
+				'math MO',
+				'math MN',
+				'math MS',
+				'math MTEXT',
+				'math ANNOTATION-XML',
+
+				'svg FOREIGNOBJECT',
+				'svg DESC',
+				'svg TITLE',
+			)
+		);
+	}
+
+	/**
+	 * Returns whether a particular element is in button scope.
+	 *
+	 * > The stack of open elements is said to have a particular element
+	 * > in button scope when it has that element in the specific scope
+	 * > consisting of the following element types:
+	 * >
+	 * >   - All the element types listed above for the has an element in scope algorithm.
+	 * >   - button in the HTML namespace
+	 *
+	 * @since 6.4.0
+	 * @since 6.7.0 Supports all required HTML elements.
+	 *
+	 * @see https://html.spec.whatwg.org/#has-an-element-in-button-scope
+	 *
+	 * @param string $tag_name Name of tag to check.
+	 * @return bool Whether given element is in scope.
+	 */
+	public function has_element_in_button_scope( string $tag_name ): bool {
+		return $this->has_element_in_specific_scope(
+			$tag_name,
+			array(
+				'APPLET',
+				'BUTTON',
+				'CAPTION',
+				'HTML',
+				'TABLE',
+				'TD',
+				'TH',
+				'MARQUEE',
+				'OBJECT',
+				'TEMPLATE',
+
+				'math MI',
+				'math MO',
+				'math MN',
+				'math MS',
+				'math MTEXT',
+				'math ANNOTATION-XML',
+
+				'svg FOREIGNOBJECT',
+				'svg DESC',
+				'svg TITLE',
+			)
+		);
+	}
+
+	/**
+	 * Returns whether a particular element is in table scope.
+	 *
+	 * > The stack of open elements is said to have a particular element
+	 * > in table scope when it has that element in the specific scope
+	 * > consisting of the following element types:
+	 * >
+	 * >   - html in the HTML namespace
+	 * >   - table in the HTML namespace
+	 * >   - template in the HTML namespace
+	 *
+	 * @since 6.4.0
+	 * @since 6.7.0 Full implementation.
+	 *
+	 * @see https://html.spec.whatwg.org/#has-an-element-in-table-scope
+	 *
+	 * @param string $tag_name Name of tag to check.
+	 * @return bool Whether given element is in scope.
+	 */
+	public function has_element_in_table_scope( string $tag_name ): bool {
+		return $this->has_element_in_specific_scope(
+			$tag_name,
+			array(
+				'HTML',
+				'TABLE',
+				'TEMPLATE',
+			)
+		);
+	}
+
+	/**
+	 * Returns whether a particular element is in select scope.
+	 *
+	 * This test differs from the others like it, in that its rules are inverted.
+	 * Instead of arriving at a match when one of any tag in a termination group
+	 * is reached, this one terminates if any other tag is reached.
+	 *
+	 * > The stack of open elements is said to have a particular element in select scope when it has
+	 * > that element in the specific scope consisting of all element types except the following:
+	 * >   - optgroup in the HTML namespace
+	 * >   - option in the HTML namespace
+	 *
+	 * @since 6.4.0 Stub implementation (throws).
+	 * @since 6.7.0 Full implementation.
+	 *
+	 * @see https://html.spec.whatwg.org/#has-an-element-in-select-scope
+	 *
+	 * @param string $tag_name Name of tag to check.
+	 * @return bool Whether the given element is in SELECT scope.
+	 */
+	public function has_element_in_select_scope( string $tag_name ): bool {
+		foreach ( $this->walk_up() as $node ) {
+			if ( $node->node_name === $tag_name ) {
+				return true;
+			}
+
+			if (
+				'OPTION' !== $node->node_name &&
+				'OPTGROUP' !== $node->node_name
+			) {
+				return false;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Returns whether a P is in BUTTON scope.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#has-an-element-in-button-scope
+	 *
+	 * @return bool Whether a P is in BUTTON scope.
+	 */
+	public function has_p_in_button_scope(): bool {
+		return $this->has_p_in_button_scope;
+	}
+
+	/**
+	 * Pops a node off of the stack of open elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#stack-of-open-elements
+	 *
+	 * @return bool Whether a node was popped off of the stack.
+	 */
+	public function pop(): bool {
+		$item = array_pop( $this->stack );
+		if ( null === $item ) {
+			return false;
+		}
+
+		$this->after_element_pop( $item );
+		return true;
+	}
+
+	/**
+	 * Pops nodes off of the stack of open elements until an HTML tag with the given name has been popped.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see WP_HTML_Open_Elements::pop
+	 *
+	 * @param string $html_tag_name Name of tag that needs to be popped off of the stack of open elements.
+	 * @return bool Whether a tag of the given name was found and popped off of the stack of open elements.
+	 */
+	public function pop_until( string $html_tag_name ): bool {
+		foreach ( $this->walk_up() as $item ) {
+			$this->pop();
+
+			if ( 'html' !== $item->namespace ) {
+				continue;
+			}
+
+			if (
+				'(internal: H1 through H6 - do not use)' === $html_tag_name &&
+				in_array( $item->node_name, array( 'H1', 'H2', 'H3', 'H4', 'H5', 'H6' ), true )
+			) {
+				return true;
+			}
+
+			if ( $html_tag_name === $item->node_name ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Pushes a node onto the stack of open elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#stack-of-open-elements
+	 *
+	 * @param WP_HTML_Token $stack_item Item to add onto stack.
+	 */
+	public function push( WP_HTML_Token $stack_item ): void {
+		$this->stack[] = $stack_item;
+		$this->after_element_push( $stack_item );
+	}
+
+	/**
+	 * Removes a specific node from the stack of open elements.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param WP_HTML_Token $token The node to remove from the stack of open elements.
+	 * @return bool Whether the node was found and removed from the stack of open elements.
+	 */
+	public function remove_node( WP_HTML_Token $token ): bool {
+		foreach ( $this->walk_up() as $position_from_end => $item ) {
+			if ( $token->bookmark_name !== $item->bookmark_name ) {
+				continue;
+			}
+
+			$position_from_start = $this->count() - $position_from_end - 1;
+			array_splice( $this->stack, $position_from_start, 1 );
+			$this->after_element_pop( $item );
+			return true;
+		}
+
+		return false;
+	}
+
+
+	/**
+	 * Steps through the stack of open elements, starting with the top element
+	 * (added first) and walking downwards to the one added last.
+	 *
+	 * This generator function is designed to be used inside a "foreach" loop.
+	 *
+	 * Example:
+	 *
+	 *     $html = '<em><strong><a>We are here';
+	 *     foreach ( $stack->walk_down() as $node ) {
+	 *         echo "{$node->node_name} -> ";
+	 *     }
+	 *     > EM -> STRONG -> A ->
+	 *
+	 * To start with the most-recently added element and walk towards the top,
+	 * see WP_HTML_Open_Elements::walk_up().
+	 *
+	 * @since 6.4.0
+	 */
+	public function walk_down() {
+		$count = count( $this->stack );
+
+		for ( $i = 0; $i < $count; $i++ ) {
+			yield $this->stack[ $i ];
+		}
+	}
+
+	/**
+	 * Steps through the stack of open elements, starting with the bottom element
+	 * (added last) and walking upwards to the one added first.
+	 *
+	 * This generator function is designed to be used inside a "foreach" loop.
+	 *
+	 * Example:
+	 *
+	 *     $html = '<em><strong><a>We are here';
+	 *     foreach ( $stack->walk_up() as $node ) {
+	 *         echo "{$node->node_name} -> ";
+	 *     }
+	 *     > A -> STRONG -> EM ->
+	 *
+	 * To start with the first added element and walk towards the bottom,
+	 * see WP_HTML_Open_Elements::walk_down().
+	 *
+	 * @since 6.4.0
+	 * @since 6.5.0 Accepts $above_this_node to start traversal above a given node, if it exists.
+	 *
+	 * @param WP_HTML_Token|null $above_this_node Optional. Start traversing above this node,
+	 *                                            if provided and if the node exists.
+	 */
+	public function walk_up( ?WP_HTML_Token $above_this_node = null ) {
+		$has_found_node = null === $above_this_node;
+
+		for ( $i = count( $this->stack ) - 1; $i >= 0; $i-- ) {
+			$node = $this->stack[ $i ];
+
+			if ( ! $has_found_node ) {
+				$has_found_node = $node === $above_this_node;
+				continue;
+			}
+
+			yield $node;
+		}
+	}
+
+	/*
+	 * Internal helpers.
+	 */
+
+	/**
+	 * Updates internal flags after adding an element.
+	 *
+	 * Certain conditions (such as "has_p_in_button_scope") are maintained here as
+	 * flags that are only modified when adding and removing elements. This allows
+	 * the HTML Processor to quickly check for these conditions instead of iterating
+	 * over the open stack elements upon each new tag it encounters. These flags,
+	 * however, need to be maintained as items are added and removed from the stack.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param WP_HTML_Token $item Element that was added to the stack of open elements.
+	 */
+	public function after_element_push( WP_HTML_Token $item ): void {
+		$namespaced_name = 'html' === $item->namespace
+			? $item->node_name
+			: "{$item->namespace} {$item->node_name}";
+
+		/*
+		 * When adding support for new elements, expand this switch to trap
+		 * cases where the precalculated value needs to change.
+		 */
+		switch ( $namespaced_name ) {
+			case 'APPLET':
+			case 'BUTTON':
+			case 'CAPTION':
+			case 'HTML':
+			case 'TABLE':
+			case 'TD':
+			case 'TH':
+			case 'MARQUEE':
+			case 'OBJECT':
+			case 'TEMPLATE':
+			case 'math MI':
+			case 'math MO':
+			case 'math MN':
+			case 'math MS':
+			case 'math MTEXT':
+			case 'math ANNOTATION-XML':
+			case 'svg FOREIGNOBJECT':
+			case 'svg DESC':
+			case 'svg TITLE':
+				$this->has_p_in_button_scope = false;
+				break;
+
+			case 'P':
+				$this->has_p_in_button_scope = true;
+				break;
+		}
+
+		if ( null !== $this->push_handler ) {
+			( $this->push_handler )( $item );
+		}
+	}
+
+	/**
+	 * Updates internal flags after removing an element.
+	 *
+	 * Certain conditions (such as "has_p_in_button_scope") are maintained here as
+	 * flags that are only modified when adding and removing elements. This allows
+	 * the HTML Processor to quickly check for these conditions instead of iterating
+	 * over the open stack elements upon each new tag it encounters. These flags,
+	 * however, need to be maintained as items are added and removed from the stack.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param WP_HTML_Token $item Element that was removed from the stack of open elements.
+	 */
+	public function after_element_pop( WP_HTML_Token $item ): void {
+		/*
+		 * When adding support for new elements, expand this switch to trap
+		 * cases where the precalculated value needs to change.
+		 */
+		switch ( $item->node_name ) {
+			case 'APPLET':
+			case 'BUTTON':
+			case 'CAPTION':
+			case 'HTML':
+			case 'P':
+			case 'TABLE':
+			case 'TD':
+			case 'TH':
+			case 'MARQUEE':
+			case 'OBJECT':
+			case 'TEMPLATE':
+			case 'math MI':
+			case 'math MO':
+			case 'math MN':
+			case 'math MS':
+			case 'math MTEXT':
+			case 'math ANNOTATION-XML':
+			case 'svg FOREIGNOBJECT':
+			case 'svg DESC':
+			case 'svg TITLE':
+				$this->has_p_in_button_scope = $this->has_element_in_button_scope( 'P' );
+				break;
+		}
+
+		if ( null !== $this->pop_handler ) {
+			( $this->pop_handler )( $item );
+		}
+	}
+
+	/**
+	 * Clear the stack back to a table context.
+	 *
+	 * > When the steps above require the UA to clear the stack back to a table context, it means
+	 * > that the UA must, while the current node is not a table, template, or html element, pop
+	 * > elements from the stack of open elements.
+	 *
+	 * @see https://html.spec.whatwg.org/multipage/parsing.html#clear-the-stack-back-to-a-table-context
+	 *
+	 * @since 6.7.0
+	 */
+	public function clear_to_table_context(): void {
+		foreach ( $this->walk_up() as $item ) {
+			if (
+				'TABLE' === $item->node_name ||
+				'TEMPLATE' === $item->node_name ||
+				'HTML' === $item->node_name
+			) {
+				break;
+			}
+			$this->pop();
+		}
+	}
+
+	/**
+	 * Clear the stack back to a table body context.
+	 *
+	 * > When the steps above require the UA to clear the stack back to a table body context, it
+	 * > means that the UA must, while the current node is not a tbody, tfoot, thead, template, or
+	 * > html element, pop elements from the stack of open elements.
+	 *
+	 * @see https://html.spec.whatwg.org/multipage/parsing.html#clear-the-stack-back-to-a-table-body-context
+	 *
+	 * @since 6.7.0
+	 */
+	public function clear_to_table_body_context(): void {
+		foreach ( $this->walk_up() as $item ) {
+			if (
+				'TBODY' === $item->node_name ||
+				'TFOOT' === $item->node_name ||
+				'THEAD' === $item->node_name ||
+				'TEMPLATE' === $item->node_name ||
+				'HTML' === $item->node_name
+			) {
+				break;
+			}
+			$this->pop();
+		}
+	}
+
+	/**
+	 * Clear the stack back to a table row context.
+	 *
+	 * > When the steps above require the UA to clear the stack back to a table row context, it
+	 * > means that the UA must, while the current node is not a tr, template, or html element, pop
+	 * > elements from the stack of open elements.
+	 *
+	 * @see https://html.spec.whatwg.org/multipage/parsing.html#clear-the-stack-back-to-a-table-row-context
+	 *
+	 * @since 6.7.0
+	 */
+	public function clear_to_table_row_context(): void {
+		foreach ( $this->walk_up() as $item ) {
+			if (
+				'TR' === $item->node_name ||
+				'TEMPLATE' === $item->node_name ||
+				'HTML' === $item->node_name
+			) {
+				break;
+			}
+			$this->pop();
+		}
+	}
+
+	/**
+	 * Wakeup magic method.
+	 *
+	 * @since 6.6.0
+	 */
+	public function __wakeup() {
+		throw new \LogicException( __CLASS__ . ' should never be unserialized' );
+	}
+}

wp-includes/html-api/class-wp-html-processor-state.php

@@ -0,0 +1,454 @@
+<?php
+/**
+ * HTML API: WP_HTML_Processor_State class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.4.0
+ */
+
+/**
+ * Core class used by the HTML processor during HTML parsing
+ * for managing the internal parsing state.
+ *
+ * This class is designed for internal use by the HTML processor.
+ *
+ * @since 6.4.0
+ *
+ * @access private
+ *
+ * @see WP_HTML_Processor
+ */
+class WP_HTML_Processor_State {
+	/*
+	 * Insertion mode constants.
+	 *
+	 * These constants exist and are named to make it easier to
+	 * discover and recognize the supported insertion modes in
+	 * the parser.
+	 *
+	 * Out of all the possible insertion modes, only those
+	 * supported by the parser are listed here. As support
+	 * is added to the parser for more modes, add them here
+	 * following the same naming and value pattern.
+	 *
+	 * @see https://html.spec.whatwg.org/#the-insertion-mode
+	 */
+
+	/**
+	 * Initial insertion mode for full HTML parser.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#the-initial-insertion-mode
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_INITIAL = 'insertion-mode-initial';
+
+	/**
+	 * Before HTML insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#the-before-html-insertion-mode
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_BEFORE_HTML = 'insertion-mode-before-html';
+
+	/**
+	 * Before head insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-beforehead
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_BEFORE_HEAD = 'insertion-mode-before-head';
+
+	/**
+	 * In head insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-inhead
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_HEAD = 'insertion-mode-in-head';
+
+	/**
+	 * In head noscript insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-inheadnoscript
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_HEAD_NOSCRIPT = 'insertion-mode-in-head-noscript';
+
+	/**
+	 * After head insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-afterhead
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_AFTER_HEAD = 'insertion-mode-after-head';
+
+	/**
+	 * In body insertion mode for full HTML parser.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-inbody
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_BODY = 'insertion-mode-in-body';
+
+	/**
+	 * In table insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-intable
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_TABLE = 'insertion-mode-in-table';
+
+	/**
+	 * In table text insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-intabletext
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_TABLE_TEXT = 'insertion-mode-in-table-text';
+
+	/**
+	 * In caption insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-incaption
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_CAPTION = 'insertion-mode-in-caption';
+
+	/**
+	 * In column group insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-incolumngroup
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_COLUMN_GROUP = 'insertion-mode-in-column-group';
+
+	/**
+	 * In table body insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-intablebody
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_TABLE_BODY = 'insertion-mode-in-table-body';
+
+	/**
+	 * In row insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-inrow
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_ROW = 'insertion-mode-in-row';
+
+	/**
+	 * In cell insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-incell
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_CELL = 'insertion-mode-in-cell';
+
+	/**
+	 * In select insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-inselect
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_SELECT = 'insertion-mode-in-select';
+
+	/**
+	 * In select in table insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-inselectintable
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_SELECT_IN_TABLE = 'insertion-mode-in-select-in-table';
+
+	/**
+	 * In template insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-intemplate
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_TEMPLATE = 'insertion-mode-in-template';
+
+	/**
+	 * After body insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-afterbody
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_AFTER_BODY = 'insertion-mode-after-body';
+
+	/**
+	 * In frameset insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-inframeset
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_IN_FRAMESET = 'insertion-mode-in-frameset';
+
+	/**
+	 * After frameset insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#parsing-main-afterframeset
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_AFTER_FRAMESET = 'insertion-mode-after-frameset';
+
+	/**
+	 * After after body insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#the-after-after-body-insertion-mode
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_AFTER_AFTER_BODY = 'insertion-mode-after-after-body';
+
+	/**
+	 * After after frameset insertion mode for full HTML parser.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#the-after-after-frameset-insertion-mode
+	 * @see WP_HTML_Processor_State::$insertion_mode
+	 *
+	 * @var string
+	 */
+	const INSERTION_MODE_AFTER_AFTER_FRAMESET = 'insertion-mode-after-after-frameset';
+
+	/**
+	 * The stack of template insertion modes.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/#the-insertion-mode:stack-of-template-insertion-modes
+	 *
+	 * @var array<string>
+	 */
+	public $stack_of_template_insertion_modes = array();
+
+	/**
+	 * Tracks open elements while scanning HTML.
+	 *
+	 * This property is initialized in the constructor and never null.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#stack-of-open-elements
+	 *
+	 * @var WP_HTML_Open_Elements
+	 */
+	public $stack_of_open_elements;
+
+	/**
+	 * Tracks open formatting elements, used to handle mis-nested formatting element tags.
+	 *
+	 * This property is initialized in the constructor and never null.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#list-of-active-formatting-elements
+	 *
+	 * @var WP_HTML_Active_Formatting_Elements
+	 */
+	public $active_formatting_elements;
+
+	/**
+	 * Refers to the currently-matched tag, if any.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @var WP_HTML_Token|null
+	 */
+	public $current_token = null;
+
+	/**
+	 * Tree construction insertion mode.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#insertion-mode
+	 *
+	 * @var string
+	 */
+	public $insertion_mode = self::INSERTION_MODE_INITIAL;
+
+	/**
+	 * Context node initializing fragment parser, if created as a fragment parser.
+	 *
+	 * @since 6.4.0
+	 * @deprecated 6.8.0 WP_HTML_Processor tracks the context_node internally.
+	 *
+	 * @var null
+	 */
+	public $context_node = null;
+
+	/**
+	 * The recognized encoding of the input byte stream.
+	 *
+	 * > The stream of code points that comprises the input to the tokenization
+	 * > stage will be initially seen by the user agent as a stream of bytes
+	 * > (typically coming over the network or from the local file system).
+	 * > The bytes encode the actual characters according to a particular character
+	 * > encoding, which the user agent uses to decode the bytes into characters.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string|null
+	 */
+	public $encoding = null;
+
+	/**
+	 * The parser's confidence in the input encoding.
+	 *
+	 * > When the HTML parser is decoding an input byte stream, it uses a character
+	 * > encoding and a confidence. The confidence is either tentative, certain, or
+	 * > irrelevant. The encoding used, and whether the confidence in that encoding
+	 * > is tentative or certain, is used during the parsing to determine whether to
+	 * > change the encoding. If no encoding is necessary, e.g. because the parser is
+	 * > operating on a Unicode stream and doesn't have to use a character encoding
+	 * > at all, then the confidence is irrelevant.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string
+	 */
+	public $encoding_confidence = 'tentative';
+
+	/**
+	 * HEAD element pointer.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @see https://html.spec.whatwg.org/multipage/parsing.html#head-element-pointer
+	 *
+	 * @var WP_HTML_Token|null
+	 */
+	public $head_element = null;
+
+	/**
+	 * FORM element pointer.
+	 *
+	 * > points to the last form element that was opened and whose end tag has
+	 * > not yet been seen. It is used to make form controls associate with
+	 * > forms in the face of dramatically bad markup, for historical reasons.
+	 * > It is ignored inside template elements.
+	 *
+	 * @todo This may be invalidated by a seek operation.
+	 *
+	 * @see https://html.spec.whatwg.org/#form-element-pointer
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var WP_HTML_Token|null
+	 */
+	public $form_element = null;
+
+	/**
+	 * The frameset-ok flag indicates if a `FRAMESET` element is allowed in the current state.
+	 *
+	 * > The frameset-ok flag is set to "ok" when the parser is created. It is set to "not ok" after certain tokens are seen.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#frameset-ok-flag
+	 *
+	 * @var bool
+	 */
+	public $frameset_ok = true;
+
+	/**
+	 * Constructor - creates a new and empty state value.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see WP_HTML_Processor
+	 */
+	public function __construct() {
+		$this->stack_of_open_elements     = new WP_HTML_Open_Elements();
+		$this->active_formatting_elements = new WP_HTML_Active_Formatting_Elements();
+	}
+}

wp-includes/html-api/class-wp-html-span.php

@@ -0,0 +1,56 @@
+<?php
+/**
+ * HTML API: WP_HTML_Span class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.2.0
+ */
+
+/**
+ * Core class used by the HTML tag processor to represent a textual span
+ * inside an HTML document.
+ *
+ * This is a two-tuple in disguise, used to avoid the memory overhead
+ * involved in using an array for the same purpose.
+ *
+ * This class is for internal usage of the WP_HTML_Tag_Processor class.
+ *
+ * @access private
+ * @since 6.2.0
+ * @since 6.5.0 Replaced `end` with `length` to more closely align with `substr()`.
+ *
+ * @see WP_HTML_Tag_Processor
+ */
+class WP_HTML_Span {
+	/**
+	 * Byte offset into document where span begins.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var int
+	 */
+	public $start;
+
+	/**
+	 * Byte length of this span.
+	 *
+	 * @since 6.5.0
+	 *
+	 * @var int
+	 */
+	public $length;
+
+	/**
+	 * Constructor.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @param int $start  Byte offset into document where replacement span begins.
+	 * @param int $length Byte length of span.
+	 */
+	public function __construct( int $start, int $length ) {
+		$this->start  = $start;
+		$this->length = $length;
+	}
+}

wp-includes/html-api/class-wp-html-stack-event.php

@@ -0,0 +1,82 @@
+<?php
+/**
+ * HTML API: WP_HTML_Stack_Event class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.6.0
+ */
+
+/**
+ * Core class used by the HTML Processor as a record for stack operations.
+ *
+ * This class is for internal usage of the WP_HTML_Processor class.
+ *
+ * @access private
+ * @since 6.6.0
+ *
+ * @see WP_HTML_Processor
+ */
+class WP_HTML_Stack_Event {
+	/**
+	 * Refers to popping an element off of the stack of open elements.
+	 *
+	 * @since 6.6.0
+	 */
+	const POP = 'pop';
+
+	/**
+	 * Refers to pushing an element onto the stack of open elements.
+	 *
+	 * @since 6.6.0
+	 */
+	const PUSH = 'push';
+
+	/**
+	 * References the token associated with the stack push event,
+	 * even if this is a pop event for that element.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @var WP_HTML_Token
+	 */
+	public $token;
+
+	/**
+	 * Indicates which kind of stack operation this event represents.
+	 *
+	 * May be one of the class constants.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @see self::POP
+	 * @see self::PUSH
+	 *
+	 * @var string
+	 */
+	public $operation;
+
+	/**
+	 * Indicates if the stack element is a real or virtual node.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @var string
+	 */
+	public $provenance;
+
+	/**
+	 * Constructor function.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @param WP_HTML_Token $token      Token associated with stack event, always an opening token.
+	 * @param string        $operation  One of self::PUSH or self::POP.
+	 * @param string        $provenance "virtual" or "real".
+	 */
+	public function __construct( WP_HTML_Token $token, string $operation, string $provenance ) {
+		$this->token      = $token;
+		$this->operation  = $operation;
+		$this->provenance = $provenance;
+	}
+}

wp-includes/html-api/class-wp-html-text-replacement.php

@@ -0,0 +1,64 @@
+<?php
+/**
+ * HTML API: WP_HTML_Text_Replacement class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.2.0
+ */
+
+/**
+ * Core class used by the HTML tag processor as a data structure for replacing
+ * existing content from start to end, allowing to drastically improve performance.
+ *
+ * This class is for internal usage of the WP_HTML_Tag_Processor class.
+ *
+ * @access private
+ * @since 6.2.0
+ * @since 6.5.0 Replace `end` with `length` to more closely match `substr()`.
+ *
+ * @see WP_HTML_Tag_Processor
+ */
+class WP_HTML_Text_Replacement {
+	/**
+	 * Byte offset into document where replacement span begins.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var int
+	 */
+	public $start;
+
+	/**
+	 * Byte length of span being replaced.
+	 *
+	 * @since 6.5.0
+	 *
+	 * @var int
+	 */
+	public $length;
+
+	/**
+	 * Span of text to insert in document to replace existing content from start to end.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @var string
+	 */
+	public $text;
+
+	/**
+	 * Constructor.
+	 *
+	 * @since 6.2.0
+	 *
+	 * @param int    $start  Byte offset into document where replacement span begins.
+	 * @param int    $length Byte length of span in document being replaced.
+	 * @param string $text   Span of text to insert in document to replace existing content from start to end.
+	 */
+	public function __construct( int $start, int $length, string $text ) {
+		$this->start  = $start;
+		$this->length = $length;
+		$this->text   = $text;
+	}
+}

wp-includes/html-api/class-wp-html-token.php

@@ -0,0 +1,126 @@
+<?php
+/**
+ * HTML API: WP_HTML_Token class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.4.0
+ */
+
+/**
+ * Core class used by the HTML processor during HTML parsing
+ * for referring to tokens in the input HTML string.
+ *
+ * This class is designed for internal use by the HTML processor.
+ *
+ * @since 6.4.0
+ *
+ * @access private
+ *
+ * @see WP_HTML_Processor
+ */
+class WP_HTML_Token {
+	/**
+	 * Name of bookmark corresponding to source of token in input HTML string.
+	 *
+	 * Having a bookmark name does not imply that the token still exists. It
+	 * may be that the source token and underlying bookmark was wiped out by
+	 * some modification to the source HTML.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @var string
+	 */
+	public $bookmark_name = null;
+
+	/**
+	 * Name of node; lowercase names such as "marker" are not HTML elements.
+	 *
+	 * For HTML elements/tags this value should come from WP_HTML_Processor::get_tag().
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see WP_HTML_Processor::get_tag()
+	 *
+	 * @var string
+	 */
+	public $node_name = null;
+
+	/**
+	 * Whether node contains the self-closing flag.
+	 *
+	 * A node may have a self-closing flag when it shouldn't. This value
+	 * only reports if the flag is present in the original HTML.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @see https://html.spec.whatwg.org/#self-closing-flag
+	 *
+	 * @var bool
+	 */
+	public $has_self_closing_flag = false;
+
+	/**
+	 * Indicates if the element is an HTML element or if it's inside foreign content.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string 'html', 'svg', or 'math'.
+	 */
+	public $namespace = 'html';
+
+	/**
+	 * Indicates which kind of integration point the element is, if any.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string|null 'math', 'html', or null if not an integration point.
+	 */
+	public $integration_node_type = null;
+
+	/**
+	 * Called when token is garbage-collected or otherwise destroyed.
+	 *
+	 * @var callable|null
+	 */
+	public $on_destroy = null;
+
+	/**
+	 * Constructor - creates a reference to a token in some external HTML string.
+	 *
+	 * @since 6.4.0
+	 *
+	 * @param string|null   $bookmark_name         Name of bookmark corresponding to location in HTML where token is found,
+	 *                                             or `null` for markers and nodes without a bookmark.
+	 * @param string        $node_name             Name of node token represents; if uppercase, an HTML element; if lowercase, a special value like "marker".
+	 * @param bool          $has_self_closing_flag Whether the source token contains the self-closing flag, regardless of whether it's valid.
+	 * @param callable|null $on_destroy            Optional. Function to call when destroying token, useful for releasing the bookmark.
+	 */
+	public function __construct( ?string $bookmark_name, string $node_name, bool $has_self_closing_flag, ?callable $on_destroy = null ) {
+		$this->bookmark_name         = $bookmark_name;
+		$this->namespace             = 'html';
+		$this->node_name             = $node_name;
+		$this->has_self_closing_flag = $has_self_closing_flag;
+		$this->on_destroy            = $on_destroy;
+	}
+
+	/**
+	 * Destructor.
+	 *
+	 * @since 6.4.0
+	 */
+	public function __destruct() {
+		if ( is_callable( $this->on_destroy ) ) {
+			call_user_func( $this->on_destroy, $this->bookmark_name );
+		}
+	}
+
+	/**
+	 * Wakeup magic method.
+	 *
+	 * @since 6.4.2
+	 */
+	public function __wakeup() {
+		throw new \LogicException( __CLASS__ . ' should never be unserialized' );
+	}
+}

wp-includes/html-api/class-wp-html-unsupported-exception.php

@@ -0,0 +1,115 @@
+<?php
+/**
+ * HTML API: WP_HTML_Unsupported_Exception class
+ *
+ * @package WordPress
+ * @subpackage HTML-API
+ * @since 6.4.0
+ */
+
+/**
+ * Core class used by the HTML processor during HTML parsing
+ * for indicating that a given operation is unsupported.
+ *
+ * This class is designed for internal use by the HTML processor.
+ *
+ * The HTML API aims to operate in compliance with the HTML5
+ * specification, but does not implement the full specification.
+ * In cases where it lacks support it should not cause breakage
+ * or unexpected behavior. In the cases where it recognizes that
+ * it cannot proceed, this class is used to abort from any
+ * operation and signify that the given HTML cannot be processed.
+ *
+ * @since 6.4.0
+ * @since 6.7.0 Gained contextual information for use in debugging parse failures.
+ *
+ * @access private
+ *
+ * @see WP_HTML_Processor
+ */
+class WP_HTML_Unsupported_Exception extends Exception {
+	/**
+	 * Name of the matched token when the exception was raised,
+	 * if matched on a token.
+	 *
+	 * This does not imply that the token itself was unsupported, but it
+	 * may have been the case that the token triggered part of the HTML
+	 * parsing that isn't supported, such as the adoption agency algorithm.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string
+	 */
+	public $token_name;
+
+	/**
+	 * Number of bytes into the input HTML document where the parser was
+	 * parsing when the exception was raised.
+	 *
+	 * Use this to reconstruct context for the failure.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var int
+	 */
+	public $token_at;
+
+	/**
+	 * Full raw text of the matched token when the exception was raised,
+	 * if matched on a token.
+	 *
+	 * Whereas the `$token_name` will be normalized, this contains the full
+	 * raw text of the token, including original casing, duplicated attributes,
+	 * and other syntactic variations that are normally abstracted in the HTML API.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string
+	 */
+	public $token;
+
+	/**
+	 * Stack of open elements when the exception was raised.
+	 *
+	 * Use this to trace the parsing circumstances which led to the exception.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string[]
+	 */
+	public $stack_of_open_elements = array();
+
+	/**
+	 * List of active formatting elements when the exception was raised.
+	 *
+	 * Use this to trace the parsing circumstances which led to the exception.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @var string[]
+	 */
+	public $active_formatting_elements = array();
+
+	/**
+	 * Constructor function.
+	 *
+	 * @since 6.7.0
+	 *
+	 * @param string   $message                    Brief message explaining what is unsupported, the reason this exception was raised.
+	 * @param string   $token_name                 Normalized name of matched token when this exception was raised.
+	 * @param int      $token_at                   Number of bytes into source HTML document where matched token starts.
+	 * @param string   $token                      Full raw text of matched token when this exception was raised.
+	 * @param string[] $stack_of_open_elements     Stack of open elements when this exception was raised.
+	 * @param string[] $active_formatting_elements List of active formatting elements when this exception was raised.
+	 */
+	public function __construct( string $message, string $token_name, int $token_at, string $token, array $stack_of_open_elements, array $active_formatting_elements ) {
+		parent::__construct( $message );
+
+		$this->token_name = $token_name;
+		$this->token_at   = $token_at;
+		$this->token      = $token;
+
+		$this->stack_of_open_elements     = $stack_of_open_elements;
+		$this->active_formatting_elements = $active_formatting_elements;
+	}
+}