From c4afc2f7fb102b0932848c5f46960333e740569f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20Zieli=C5=84ski?= <adam@adamziel.com>
Date: Wed, 12 Aug 2026 13:31:22 +0200
Subject: [PATCH] [PHP] Classify CSS and JSON script text

---
 ...utious-text-block-markup-url-processor.php |  4 +--
 .../class-structured-data-url-rewriter.php    | 33 +++++++++++++++++++
 .../StructuredDataUrlRewriterTest.php         | 18 ++++++++++
 3 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/packages/reprint-client/src/lib/url-rewrite/class-cautious-text-block-markup-url-processor.php b/packages/reprint-client/src/lib/url-rewrite/class-cautious-text-block-markup-url-processor.php
index 4d89a723..3da501ef 100644
--- a/packages/reprint-client/src/lib/url-rewrite/class-cautious-text-block-markup-url-processor.php
+++ b/packages/reprint-client/src/lib/url-rewrite/class-cautious-text-block-markup-url-processor.php
@@ -59,7 +59,7 @@ public function replace_raw_current_text(string $updated_text): bool
     }
 
     /**
-     * Replace configured URL bases in the current raw text token.
+     * Replace configured URL bases in the current raw modifiable text.
      *
      * WP_HTML_Tag_Processor exposes decoded text through get_modifiable_text()
      * and HTML-encodes the complete replacement in set_modifiable_text(). The
@@ -70,7 +70,7 @@ public function replace_raw_current_text(string $updated_text): bool
      */
     public function replace_url_bases_in_current_text(array $url_mapping): bool
     {
-        if ('#text' !== $this->get_token_type()) {
+        if ($this->get_token_type() !== '#text' && $this->get_token_type() !== '#tag') {
             return false;
         }
 
diff --git a/packages/reprint-client/src/lib/url-rewrite/class-structured-data-url-rewriter.php b/packages/reprint-client/src/lib/url-rewrite/class-structured-data-url-rewriter.php
index 721cc25d..a558e8d0 100644
--- a/packages/reprint-client/src/lib/url-rewrite/class-structured-data-url-rewriter.php
+++ b/packages/reprint-client/src/lib/url-rewrite/class-structured-data-url-rewriter.php
@@ -481,6 +481,13 @@ private function rewrite_urls( string $content, string $content_type ): string {
                         continue;
                     }
 
+                    if ($this->token_has_css_or_json_text($p)) {
+                        $text = $p->get_modifiable_text();
+                        if ($this->maybe_contains_rewritable_urls($text)) {
+                            $p->replace_url_bases_in_current_text($this->url_mapping);
+                        }
+                    }
+
                     while ( $p->next_url_in_current_token() ) {
                         $raw_url = $p->get_raw_url();
                         $cache_key = $this->mapping_cache_key . "\0" . self::BLOCK_MARKUP . "\0" . $token_type . "\0" . $raw_url;
@@ -572,6 +579,32 @@ private function rewrite_urls( string $content, string $content_type ): string {
         }
     }
 
+    /**
+     * Return whether the current tag owns CSS or JSON text. Those values are
+     * raw text in the HTML tokenizer, not ordinary HTML text nodes. Keep their
+     * original escaping while the cautious processor replaces only a mapped
+     * URL base.
+     */
+    private function token_has_css_or_json_text(CautiousTextBlockMarkupUrlProcessor $processor): bool
+    {
+        $tag = strtolower($processor->get_tag() ?? '');
+        if ($tag === 'style') {
+            return true;
+        }
+
+        if ($tag !== 'script') {
+            return false;
+        }
+
+        $type = $processor->get_attribute('type');
+        if (!is_string($type)) {
+            return false;
+        }
+
+        $mime_type = strtolower(trim(explode(';', $type, 2)[0]));
+        return $mime_type === 'application/ld+json' || $mime_type === 'application/json';
+    }
+
     /**
      * Rewrite a Base64 payload which is the complete body of a shortcode.
      *
diff --git a/tests/UrlRewriting/StructuredDataUrlRewriterTest.php b/tests/UrlRewriting/StructuredDataUrlRewriterTest.php
index 873a1b96..84ededb8 100644
--- a/tests/UrlRewriting/StructuredDataUrlRewriterTest.php
+++ b/tests/UrlRewriting/StructuredDataUrlRewriterTest.php
@@ -377,6 +377,24 @@ public function testBlockMarkupRewritesBase64ShortcodeBody(): void
         $this->assertSame($expected, $rewriter->rewrite($input, 'block_markup'));
     }
 
+    public function testBlockMarkupUsesCautiousReplacementInStyleTagText(): void
+    {
+        $rewriter = $this->createRewriter();
+        $input = '<style>.hero{background:url(https:\\/\\/old-site.com\\/uploads\\/hero.jpg)}</style>';
+        $expected = '<style>.hero{background:url(https:\\/\\/new-site.com\\/uploads\\/hero.jpg)}</style>';
+
+        $this->assertSame($expected, $rewriter->rewrite($input, 'block_markup'));
+    }
+
+    public function testBlockMarkupUsesCautiousReplacementInJsonScriptText(): void
+    {
+        $rewriter = $this->createRewriter();
+        $input = '<script type="application/ld+json; charset=UTF-8">{"image":"https:\\/\\/old-site.com\\/uploads\\/logo.png"}</script>';
+        $expected = '<script type="application/ld+json; charset=UTF-8">{"image":"https:\\/\\/new-site.com\\/uploads\\/logo.png"}</script>';
+
+        $this->assertSame($expected, $rewriter->rewrite($input, 'block_markup'));
+    }
+
     /**
      * @return array<string, array{0:string, 1:string}>
      */