[bor0]

Proposed Changes

• In o2Editor.getEditor(), decode the textarea's placeholder before setting it on the editor.
• Add a QUnit test in tests/qunit/editor.js.

o2 saves a custom new-post prompt with esc_attr() (o2.php, front_side_post_prompt), so What's is stored as What's. The editor used to build the textarea from an HTML string, which decoded it. Since #252 the placeholder is set with .attr(), so the editor shows What's literally. The prompt is now decoded once through a detached <textarea>, which parses its content as text, so markup in a prompt still can't create elements.

Testing Instructions

• Set the new-post prompt to something with an apostrophe and save it through the Customizer. On master the editor placeholder shows '; on this branch it shows '.
• npx grunt qunit passes. The new test fails without the fix.

🤖 Generated with Claude Code

[lancewillett]

Blocker in js/editor/editor.js:158: jQuery .html() parses the string as live HTML when it contains <script, <style or <link, or starts with a table tag like <tr>. With jQuery 3.7.1, <style></style><img src=x onerror=…> runs its onerror handler.

Use $( '<textarea>' ).prop( 'innerHTML', … ).val() instead, and add a <style> case to the QUnit test. The current cases all take jQuery's safe path, so they can't catch this.

_{AI review · claude-opus-5-5}

[lancewillett]

Left a review comment with a few changes before we merge this.