Good to hear from you, Jeff! Thanks for the note – we’re pretty excited about these modern features in WordPress and the work on this block theme has been fueled by that excitement, for sure.

Haven’t done webdev in years, completely forgotten about the webroot issue when debugging.
Saved my bacon, thanks!

Thanks for sharing the article. One thing I always like pointing out is that even with all that code for your PCRE-based approach, it’s still wrong.

In fact, the DOMDocument approach is also broken. A trivial case to see this is if that example HTML is placed inside a TEXTAREA element, as even DOMDocument will falsely identify tags in there (PHP 8.4 with \DOM\HtmlDocument will help this). Worse still, DOMDocument will corrupt documents it doesn’t understand and remove legitimate content, injecting potential security exploits. These are just two small examples among thousands.

So why go through all the effort and pain and manual work just to find out that it’s still vulnerable?

Something is unexpected in your timings. In my own benchmarks I’ve found that the Tag Processor is roughly 50% faster than DOMDocument. I wonder what’s different. Please reach out if you’d like to examine deeper.

There appear to be a few extraneous escaping characters in this blog post. One example shows two slashes when creating the Tag Processor for the root-level namespace, but only one belongs. Similarly, some of the PCRE patterns have extra backslashes.

If you haven’t seen them already, you’ll probably love what’s coming in WordPress 6.7 and 6.8 in the HTML Processor.

function bp_custom_user_nav_items() {
global $bp;

// First custom nav item
$args1 = array(
‘name’ => __(‘My events’, ‘buddypress’),
‘slug’ => ‘my-events’,
‘default_subnav_slug’ => ‘events’,
‘position’ => 50,
‘show_for_displayed_user’ => false,
‘screen_function’ => ‘bp_custom_user_nav_item_screen’,
‘item_css_id’ => ‘my-events’
);
bp_core_new_nav_item( $args1 );

// Second custom nav item
$args2 = array(
‘name’ => __(‘My second page’, ‘buddypress’),
‘slug’ => ‘my-second-page’,
‘default_subnav_slug’ => ‘second-page’,
‘position’ => 60,
‘show_for_displayed_user’ => false,
‘screen_function’ => ‘bp_custom_second_nav_item_screen’,
‘item_css_id’ => ‘my-second-page’
);
bp_core_new_nav_item( $args2 );

// Third custom nav item
$args3 = array(
‘name’ => __(‘My third page’, ‘buddypress’),
‘slug’ => ‘my-third-page’,
‘default_subnav_slug’ => ‘third-page’,
‘position’ => 70,
‘show_for_displayed_user’ => false,
‘screen_function’ => ‘bp_custom_third_nav_item_screen’,
‘item_css_id’ => ‘my-third-page’
);
bp_core_new_nav_item( $args3 );
}
add_action( ‘bp_setup_nav’, ‘bp_custom_user_nav_items’, 99 );

function bp_custom_user_nav_item_screen() {
add_action( ‘bp_template_content’, ‘bp_custom_screen_content’ );
bp_core_load_template( apply_filters( ‘bp_core_template_plugin’, ‘members/single/plugins’ ) );
}

function bp_custom_second_nav_item_screen() {
add_action( ‘bp_template_content’, ‘bp_custom_second_screen_content’ );
bp_core_load_template( apply_filters( ‘bp_core_template_plugin’, ‘members/single/plugins’ ) );
}

function bp_custom_third_nav_item_screen() {
add_action( ‘bp_template_content’, ‘bp_custom_third_screen_content’ );
bp_core_load_template( apply_filters( ‘bp_core_template_plugin’, ‘members/single/plugins’ ) );
}

function bp_custom_screen_content() {
echo ‘[tribe-user-event-confirmations]’;
}

function bp_custom_second_screen_content() {
echo ‘Content for my second page’;
}

function bp_custom_third_screen_content() {
echo ‘Content for my third page’;
}