Verbum Comments: optimize block filtering performance with Block_Scanner pre-filtering #44996

LiamSarsfield · 2025-08-28T12:02:37Z

Fixes HOG-297: Investigate usability of Block_Scanner within Verbum_Block_Utils

Proposed changes:

Optimize Verbum comment block filtering performance using hybrid Block_Scanner approach
Add Block_Scanner-based pre-filtering to detect disallowed blocks without expensive parse_blocks() processing
Fall back to existing parse_blocks() approach only when disallowed blocks are detected
Add block-delimiter package dependency to jetpack-mu-wpcom
Maintain 100% backward compatibility and identical filtering behavior

Other information:

Have you written new tests for your changes, if applicable?
Have you checked the E2E test CI results, and verified that your changes do not break them?
Have you tested your changes on WordPress.com, if applicable (if so, you'll see a generated comment below with a script to run)?

Jetpack product discussion

N/A

Does this pull request change what data or activity we track or use?

N/A

Testing instructions:

This needs to be tested in both Atomic and Simple.

Create, or use an existing Atomic/Simple (depending on which one you're testing) site.
Follow the instructions in this comment to ensure your Sandbox has the branch code.
For simple only: ensure your hosts file has said simple site's domain pointed to your sandbox IP.
Open the network tab on your dev console.
While network tab is opened, go to a post that you can comment on on your Simple site.
Comment a post with an image block (allowed block)
Verify the comment is posted successfully, and monitor your network tab for a POST request to /wp-comments-post.php
Right click the network request, and go copy -> copy as fetch
Paste the code into your browser, but do not execute it yet
Copy the following value %3C!--%20wp%3Alatest-posts%20%2F--%3E (which is encodeURIComponent())
Replace a portion of the fetch's second argument's body key to between comment= and &hc_post_as= to comment=%3C!--%20wp%3Alatest-posts%20%2F--%3E&hc_post_as=
Execute the code, if you sent it right, you should see the below payload's data

Verify a comment has not been added with said latest posts block, as this is not allowed
Repeat the same steps for either Simple/Atomic if not done so already.

- Added the "automattic/block-delimiter" package to composer.json. - Enhanced the Verbum_Block_Utils class to utilize Block_Scanner for faster detection of disallowed blocks, improving performance by avoiding unnecessary parsing in cases where all blocks are allowed. Introduced fallback methods for handling disallowed blocks when detected.

github-actions · 2025-08-28T12:03:36Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (WordPress.com Site Helper), and enable the update/verbum/allowed-blocks-checker-HOG-297 branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack-mu-wpcom-plugin update/verbum/allowed-blocks-checker-HOG-297

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

github-actions · 2025-08-28T12:03:42Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Review, ...).
✅ Add a "[Type]" label (Bug, Enhancement, Janitorial, Task).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

Mu Wpcom plugin:

Next scheduled release: WordPress.com Simple releases happen semi-continuously (PCYsg-Jjm-p2)

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

Wpcomsh plugin:

Next scheduled release: Atomic deploys happen twice daily on weekdays (p9o2xV-2EN-p2)

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

jp-launch-control · 2025-08-28T12:06:47Z

Code Coverage Summary

Coverage changed in 1 file.

File	Coverage	Δ%	Δ Uncovered
projects/packages/jetpack-mu-wpcom/src/features/verbum-comments/assets/class-verbum-block-utils.php	70/80 (87.50%)	-1.21%	3 ❤️‍🩹

Full summary · PHP report

- Updated the Verbum_Block_Utils class to return unslashed content for consistency across processing paths. - Added validation for $allowedtags to prevent override warnings. - Introduced comprehensive tests for handling malformed block delimiters, Unicode edge cases, block type spoofing, and resource limits to ensure robust security and consistent input validation.

- Introduced the "automattic/block-delimiter" package with its dependencies and autoload configurations. - Updated the reference for "automattic/jetpack-mu-wpcom" to ensure compatibility with the new package.

- Removed redundant comments and simplified the logic for returning unslashed content. - Updated the method documentation for clarity. - Enhanced the handling of innerHTML to ensure it is set correctly when not defined.

…d-blocks-checker-HOG-297

dilirity

Nice work on this! I added some questions but they are in no way blockers, more like wonderings.

dilirity · 2025-09-04T11:52:20Z

...s/packages/jetpack-mu-wpcom/src/features/verbum-comments/assets/class-verbum-block-utils.php

+	 * @param string $content Unslashed content to scan.
+	 * @return bool True if disallowed blocks found, false if all blocks are allowed.
+	 */
+	private static function has_disallowed_blocks_fast( $content ) {


Nitpick: I think the fast part is not necessary. There's no slow equivalent :D

dilirity · 2025-09-04T11:53:38Z

...s/packages/jetpack-mu-wpcom/src/features/verbum-comments/assets/class-verbum-block-utils.php

+	 */
+	private static function has_disallowed_blocks_fast( $content ) {
+		if ( ! class_exists( '\\Automattic\\Block_Scanner' ) ) {
+			return true;


I was going back and forth about the function returning true (has disallowed blocks) but I think it makes sense. This way we default back to always using parse blocks if we can't use the Block_Scanner.

dilirity · 2025-09-04T12:00:04Z

...s/packages/jetpack-mu-wpcom/src/features/verbum-comments/assets/class-verbum-block-utils.php

+		// Validate $allowedtags integrity - use local variable to avoid override warning
+		$validated_allowedtags = $allowedtags;
+		if ( ! is_array( $validated_allowedtags ) ) {
+			$validated_allowedtags = wp_kses_allowed_html( 'post' );
+		}


This is to just make sure that we're working with correct data, right? Just making sure 😅

Yup! Correct, just an extra defensive measure.

…larity and performance. Updated method name from `has_disallowed_blocks_fast` to `has_disallowed_blocks` and adjusted documentation accordingly.

dilirity

LiamSarsfield added 2 commits August 28, 2025 12:57

changelog

62dfa6f

github-actions bot added [mu wpcom Feature] Verbum Comments Verbum, a better comment experience, app developed in the mu-wpcom plugin [Package] Jetpack mu wpcom WordPress.com Features [Status] In Progress labels Aug 28, 2025

github-actions bot added the [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. label Aug 28, 2025

LiamSarsfield added [Type] Enhancement Changes to an existing feature — removing, adding, or changing parts of it and removed [Status] Needs Author Reply We need more details from you. This label will be auto-added until the PR meets all requirements. labels Aug 28, 2025

LiamSarsfield changed the title ~~Update/verbum/allowed-blocks-checker-HOG-297~~ Verbum Comments: optimize block filtering performance with Block_Scanner pre-filtering Aug 28, 2025

LiamSarsfield added 2 commits August 28, 2025 17:05

changelog

cd78c89

github-actions bot added [Plugin] Wpcomsh [Tests] Includes Tests labels Aug 28, 2025

LiamSarsfield added 2 commits August 28, 2025 21:45

Add Block Delimiter package to composer.lock

1c1e9d2

- Introduced the "automattic/block-delimiter" package with its dependencies and autoload configurations. - Updated the reference for "automattic/jetpack-mu-wpcom" to ensure compatibility with the new package.

changelog

b8c6743

github-actions bot added the [Plugin] mu wpcom jetpack-mu-wpcom plugin label Aug 28, 2025

LiamSarsfield added 4 commits August 28, 2025 21:54

Refactor Verbum_Block_Utils for streamlined block processing

c297a3d

- Removed redundant comments and simplified the logic for returning unslashed content. - Updated the method documentation for clarity. - Enhanced the handling of innerHTML to ensure it is set correctly when not defined.

Make phan happy

6c179ea

Merge remote-tracking branch 'origin/trunk' into update/verbum/allowe…

4155e35

…d-blocks-checker-HOG-297

Update composer.lock

26776ab

LiamSarsfield requested review from a team, dilirity and kraftbj September 1, 2025 15:12

LiamSarsfield marked this pull request as ready for review September 1, 2025 15:12

dilirity added [Status] Needs Review This PR is ready for review. and removed [Status] In Progress labels Sep 4, 2025

dilirity previously approved these changes Sep 4, 2025

View reviewed changes

Refactor disallowed blocks check in Verbum_Block_Utils for improved c…

ed7a2b0

…larity and performance. Updated method name from `has_disallowed_blocks_fast` to `has_disallowed_blocks` and adjusted documentation accordingly.

LiamSarsfield dismissed dilirity’s stale review via ed7a2b0 September 8, 2025 14:04

LiamSarsfield requested a review from dilirity September 8, 2025 14:05

dilirity approved these changes Sep 9, 2025

View reviewed changes

LiamSarsfield merged commit 5194408 into trunk Sep 9, 2025
64 checks passed

LiamSarsfield deleted the update/verbum/allowed-blocks-checker-HOG-297 branch September 9, 2025 13:01

github-actions bot removed the [Status] Needs Review This PR is ready for review. label Sep 9, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Verbum Comments: optimize block filtering performance with Block_Scanner pre-filtering #44996

Verbum Comments: optimize block filtering performance with Block_Scanner pre-filtering #44996

Uh oh!

LiamSarsfield commented Aug 28, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Aug 28, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Aug 28, 2025 •

edited

Loading

Uh oh!

jp-launch-control bot commented Aug 28, 2025 •

edited

Loading

Uh oh!

dilirity left a comment

Uh oh!

dilirity Sep 4, 2025

Uh oh!

dilirity Sep 4, 2025

Uh oh!

dilirity Sep 4, 2025

Uh oh!

LiamSarsfield Sep 8, 2025

Uh oh!

dilirity left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Verbum Comments: optimize block filtering performance with Block_Scanner pre-filtering #44996

Verbum Comments: optimize block filtering performance with Block_Scanner pre-filtering #44996

Uh oh!

Conversation

LiamSarsfield commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes:

Other information:

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

Uh oh!

github-actions bot commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jp-launch-control bot commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

dilirity left a comment

Choose a reason for hiding this comment

Uh oh!

dilirity Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

dilirity Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

dilirity Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

LiamSarsfield Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

dilirity left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

LiamSarsfield commented Aug 28, 2025 •

edited

Loading

github-actions bot commented Aug 28, 2025 •

edited

Loading

github-actions bot commented Aug 28, 2025 •

edited

Loading

jp-launch-control bot commented Aug 28, 2025 •

edited

Loading