Block Bindings: Don't show protected fields that are bound to blocks

lib/compat/wordpress-6.5/block-bindings/post-meta.php

@@ -28,6 +28,19 @@ function gutenberg_block_bindings_post_meta_callback( $source_attrs, $block_inst
 		return null;
 	}
 
+	// Check if the meta field is protected.
+	if ( is_protected_meta( $source_attrs['key'], 'post' ) ) {
+		return null;
+	}
+
+	// Check if the meta field is registered to be shown in REST.
+	$meta_keys = get_registered_meta_keys( 'post', $block_instance->context['postType'] );
+	// Add fields registered for all subtypes.
+	$meta_keys = array_merge( $meta_keys, get_registered_meta_keys( 'post', '' ) );
+	if ( empty( $meta_keys[ $source_attrs['key'] ]['show_in_rest'] ) || false === $meta_keys[ $source_attrs['key'] ]['show_in_rest'] ) {
+		return null;
+	}
+
 	return get_post_meta( $post_id, $source_attrs['key'], true );
 }
 

packages/e2e-tests/plugins/block-bindings.php

@@ -21,7 +21,6 @@ function gutenberg_test_block_bindings_register_custom_fields() {
 			'default'      => 'Value of the text_custom_field',
 		)
 	);
-	// TODO: Change url.
 	register_meta(
 		'post',
 		'url_custom_field',
@@ -32,5 +31,24 @@ function gutenberg_test_block_bindings_register_custom_fields() {
 			'default'      => '#url-custom-field',
 		)
 	);
+	register_meta(
+		'post',
+		'_protected_field',
+		array(
+			'type'    => 'string',
+			'single'  => true,
+			'default' => 'protected field value',
+		)
+	);
+	register_meta(
+		'post',
+		'show_in_rest_false_field',
+		array(
+			'show_in_rest' => false,
+			'type'         => 'string',
+			'single'       => true,
+			'default'      => 'show_in_rest false field value',
+		)
+	);
 }
 add_action( 'init', 'gutenberg_test_block_bindings_register_custom_fields' );

test/e2e/specs/editor/various/block-bindings.spec.js

@@ -1218,7 +1218,7 @@
 					name: 'core/paragraph',
 					attributes: {
 						anchor: 'paragraph-binding',
-						content: 'p',
+						content: 'fallback value',
 						metadata: {
 							bindings: {
 								content: {
@@ -1244,9 +1244,73 @@
 				// Check the frontend doesn't show the content.
 				const postId = await editor.publishPost();
 				await page.goto( `/?p=${ postId }` );
-				await expect(
-					page.locator( '#paragraph-binding' )
-				).toBeHidden();
+				await expect( page.locator( '#paragraph-binding' ) ).toHaveText(
+					'fallback value'
+				);
+			} );
+
+			test( 'should not show the value of a protected meta field', async ( {
+				editor,
+				page,
+			} ) => {
+				await editor.insertBlock( {
+					name: 'core/paragraph',
+					attributes: {
+						anchor: 'paragraph-binding',
+						content: 'fallback value',
+						metadata: {
+							bindings: {
+								content: {
+									source: 'core/post-meta',
+									args: { key: '_protected_field' },
+								},
+							},
+						},
+					},
+				} );
+				const paragraphBlock = editor.canvas.getByRole( 'document', {
+					name: 'Block: Paragraph',
+				} );
+				await expect( paragraphBlock ).toHaveText( '_protected_field' );
+				// Check the frontend doesn't show the content.
+				const postId = await editor.publishPost();
+				await page.goto( `/?p=${ postId }` );
+				await expect( page.locator( '#paragraph-binding' ) ).toHaveText(
+					'fallback value'
+				);
+			} );
+
+			test( 'should not show the value of a meta field with `show_in_rest` false', async ( {
+				editor,
+				page,
+			} ) => {
+				await editor.insertBlock( {
+					name: 'core/paragraph',
+					attributes: {
+						anchor: 'paragraph-binding',
+						content: 'fallback value',
+						metadata: {
+							bindings: {
+								content: {
+									source: 'core/post-meta',
+									args: { key: 'show_in_rest_false_field' },
+								},
+							},
+						},
+					},
+				} );
+				const paragraphBlock = editor.canvas.getByRole( 'document', {
+					name: 'Block: Paragraph',
+				} );
+				await expect( paragraphBlock ).toHaveText(
+					'show_in_rest_false_field'
+				);
+				// Check the frontend doesn't show the content.
+				const postId = await editor.publishPost();
+				await page.goto( `/?p=${ postId }` );
+				await expect( page.locator( '#paragraph-binding' ) ).toHaveText(
+					'fallback value'
+				);
 			} );
 		} );