How should dynamic blocks handle escaping inner blocks?

[fabiankaegy]

This is an open question that we thus far have not found the best answer for. When a block has inner blocks it gets the html content of these inner blocks passed in via the second parameter of the render_callback function.

register_block_type_from_metadata(
    __DIR__,
    [
        'render_callback' => function ( $attributes, $content, $block ) {
            // how should the $content variable get escaped when it gets output? 
        }
    ]
);

when you run wp_kses_post( $content ) that breaks functionality like the core embed block. Some filters like the oembed system in WordPress get applied to the block before it gets passed into a parent block.

We've also tried to apply the the_content filters on the block content to get the oembed to work again but that has no success.

echo apply_filters( 'the_content', wp_kses_post( $content ) );

[fabiankaegy]

For reference, the actual rendering of the block and it's inner blocks happens here: https://github.com/WordPress/wordpress-develop/blob/ef404e2599b7e9ff0a9568d0f7348731e89f5f14/src/wp-includes/class-wp-block.php#L205-L304

[fabiankaegy]

This section in the Best Practices needs to get updated with whatever solution we have come up with: https://github.com/10up/gutenberg-best-practices/blob/main/06-wordpress-packages/02-wordpress-block-editor/01-inner-blocks.md.md#server-side-rendering

[fabiankaegy]

I have created a public Q&A ticket on the Gutenberg Repository for it here: WordPress/gutenberg#37823

[turtlepod]

I think we simply need to not escape the output for this.
but we probably need to create a helper function.

example in core:
https://developer.wordpress.org/reference/functions/the_post_thumbnail/
https://developer.wordpress.org/reference/functions/the_title/

the core doesn't use wp_kses_post in this function probably for the same reason.

// the_post_thumbnail
echo get_the_post_thumbnail( null, $size, $attr);
// the_title
echo $title;