diff --git a/src/wp-includes/html-api/class-wp-html-processor.php b/src/wp-includes/html-api/class-wp-html-processor.php
index 35d91fad3129c..244b95dc9c7c0 100644
--- a/src/wp-includes/html-api/class-wp-html-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-processor.php
@@ -5474,6 +5474,17 @@ public function get_attribute_names_with_prefix( $prefix ): ?array {
/**
* Adds a new class name to the currently matched tag.
*
+ * Whitespace in `$class_name` is preserved verbatim. This may result
+ * in multiple class names being added to the element's class list.
+ *
+ * Examples:
+ *
+ * $p->add_class( 'wp-block' );
+ * // Adds one class: "wp-block".
+ *
+ * $p->add_class( 'wp-block alignwide' );
+ * // Adds two classes: "wp-block" and "alignwide".
+ *
* @since 6.6.0 Subclassed for the HTML Processor.
*
* @param string $class_name The class name to add.
@@ -5487,6 +5498,7 @@ public function add_class( $class_name ): bool {
* Removes a class name from the currently matched tag.
*
* @since 6.6.0 Subclassed for the HTML Processor.
+ * @since 7.1.0 Returns false when `$class_name` contains ASCII whitespace.
*
* @param string $class_name The class name to remove.
* @return bool Whether the class was set to be removed.
diff --git a/src/wp-includes/html-api/class-wp-html-tag-processor.php b/src/wp-includes/html-api/class-wp-html-tag-processor.php
index 77c1a471db5b1..53a207ec04cda 100644
--- a/src/wp-includes/html-api/class-wp-html-tag-processor.php
+++ b/src/wp-includes/html-api/class-wp-html-tag-processor.php
@@ -1242,6 +1242,15 @@ public function has_class( $wanted_class ): ?bool {
return null;
}
+ if ( false !== strpbrk( $wanted_class, " \t\f\r\n" ) ) {
+ _doing_it_wrong(
+ __METHOD__,
+ __( 'A class name cannot contain ASCII whitespace.' ),
+ '7.1.0'
+ );
+ return false;
+ }
+
$case_insensitive = self::QUIRKS_MODE === $this->compat_mode;
$wanted_length = strlen( $wanted_class );
@@ -4537,6 +4546,17 @@ public function remove_attribute( $name ): bool {
/**
* Adds a new class name to the currently matched tag.
*
+ * Whitespace in `$class_name` is preserved verbatim. This may result
+ * in multiple class names being added to the element's class list.
+ *
+ * Examples:
+ *
+ * $p->add_class( 'wp-block' );
+ * // Adds one class: "wp-block".
+ *
+ * $p->add_class( 'wp-block alignwide' );
+ * // Adds two classes: "wp-block" and "alignwide".
+ *
* @since 6.2.0
*
* @param string $class_name The class name to add.
@@ -4580,6 +4600,7 @@ public function add_class( $class_name ): bool {
* Removes a class name from the currently matched tag.
*
* @since 6.2.0
+ * @since 7.1.0 Returns false when `$class_name` contains ASCII whitespace.
*
* @param string $class_name The class name to remove.
* @return bool Whether the class was set to be removed.
@@ -4592,6 +4613,15 @@ public function remove_class( $class_name ): bool {
return false;
}
+ if ( false !== strpbrk( $class_name, " \t\f\r\n" ) ) {
+ _doing_it_wrong(
+ __METHOD__,
+ __( 'A class name cannot contain ASCII whitespace.' ),
+ '7.1.0'
+ );
+ return false;
+ }
+
if ( self::QUIRKS_MODE !== $this->compat_mode ) {
$this->classname_updates[ $class_name ] = self::REMOVE_CLASS;
return true;