Error loading block: the response is not a valid JSON response

Hi. We’re receiving errors when inserting WPForm blocks, in both WPForms V 1.8.2.1 and the one published today (V 1.8.2.2).

On selecting WPForms block, the pane to select a form appears just fine, but on selecting a form (any form) from the dropdown, the block suddenly renders only the following error message:

Error loading block: The response is not a valid JSON response.

The forms render and function properly on the frontend despite the error being reported in the editor.

We use 7G Firewall from PerishablePress, a very lightweight set of rewrite rules added to our sites .htaccess file. The error logs for the firewall are reporting the following:

109.156.***.*** - 2023/06/28 14:04:44 - GET - HTTP/2.0 - /wp-json/wp/v2/block-renderer/wpforms/form-selector - context=edit&attributes%5BclientId%5D=66cc45c6-4ff2-4393-b49d-72db69280b5e&attributes%5BformId%5D=499&attributes%5BdisplayTitle%5D=false&attributes%5BdisplayDesc%5D=false&attributes%5BfieldSize%5D=medium&attributes%5BfieldBorderRadius%5D=3px&attributes%5BfieldBackgroundColor%5D=%23ffffff&attributes%5BfieldBorderColor%5D=rgba(%200%2C%200%2C%200%2C%200.25%20)&attributes%5BfieldTextColor%5D=rgba(%200%2C%200%2C%200%2C%200.7%20)&attributes%5BlabelSize%5D=medium&attributes%5BlabelColor%5D=rgba(%200%2C%200%2C%200%2C%200.85%20)&attributes%5BlabelSublabelColor%5D=rgba(%200%2C%200%2C%200%2C%200.55%20)&attributes%5BlabelErrorColor%5D=%23d63637&attributes%5BbuttonSize%5D=medium&attributes%5BbuttonBorderRadius%5D=3px&attributes%5BbuttonBackgroundColor%5D=%23066aab&attributes%5BbuttonTextColor%5D=%23ffffff&attributes%5BcopyPasteValue%5D=%7B%22displayTitle%22%3Afalse%2C%22displayDesc%22%3Afalse%2C%22fieldSize%22%3A%22medium%22%2C%22fieldBorderRadius%22%3A%223px%22%2C%22fieldBackgroundColor%22%3A%22%23ffffff%22%2C%22fieldBorderColor%22%3A%22rgba(%200%2C%200%2C%200%2C%200.25%20)%22%2C%22fieldTextColor%22%3A%22rgba(%200%2C%200%2C%200%2C%200.7%20)%22%2C%22labelSize%22%3A%22medium%22%2C%22labelColor%22%3A%22rgba(%200%2C%200%2C%200%2C%200.85%20)%22%2C%22labelSublabelColor%22%3A%22rgba(%200%2C%200%2C%200%2C%200.55%20)%22%2C%22labelErrorColor%22%3A%22%23d63637%22%2C%22buttonSize%22%3A%22medium%22%2C%22buttonBorderRadius%22%3A%223px%22%2C%22buttonBackgroundColor%22%3A%22%23066aab%22%2C%22buttonTextColor%22%3A%22%23ffffff%22%7D&post_id=34&_locale=user [e] [V] [a] - - https://staging.**OBFUSCATED**.com/wp-admin/post.php?post=34&action=edit - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.58

By removing “modules” one-by-one of the 7G firewall, we’ve identified it’s the Query String module that WPForms has become incompatible with since 1.8.2.1. WPForms worked flawlessly with these rewrite rules in all its version prior to 1.8.2.1.

By removing the Query String module from the 7G rewrite rules (module pasted below), the WPForms we insert in the editor render within the editor perfectly. Downgrading our security to accommodate WPForms isn’t an option.

# 7G:[QUERY STRING]
<IfModule mod_rewrite.c>

RewriteCond %{QUERY_STRING} ([a-z0-9]{2000,}) [NC,OR]
RewriteCond %{QUERY_STRING} (/|%2f)(:|%3a)(/|%2f) [NC,OR]
RewriteCond %{QUERY_STRING} (order(\s|%20)by(\s|%20)1--) [NC,OR]
RewriteCond %{QUERY_STRING} (/|%2f)(\*|%2a)(\*|%2a)(/|%2f) [NC,OR]
RewriteCond %{QUERY_STRING} (ckfinder|fckeditor|fullclick) [NC,OR]
RewriteCond %{QUERY_STRING} (`|<|>|\^|\|\\|0x00|%00|%0d%0a) [NC,OR]
RewriteCond %{QUERY_STRING} ((.*)header:|(.*)set-cookie:(.*)=) [NC,OR]
RewriteCond %{QUERY_STRING} (localhost|127(\.|%2e)0(\.|%2e)0(\.|%2e)1) [NC,OR]
RewriteCond %{QUERY_STRING} (cmd|command)(=|%3d)(chdir|mkdir)(.*)(x20) [NC,OR]
RewriteCond %{QUERY_STRING} (globals|mosconfig([a-z_]{1,22})|request)(=|\[) [NC,OR]
RewriteCond %{QUERY_STRING} (/|%2f)((wp-)?config)((\.|%2e)inc)?((\.|%2e)php) [NC,OR]
RewriteCond %{QUERY_STRING} (thumbs?(_editor|open)?|tim(thumbs?)?)((\.|%2e)php) [NC,OR]
RewriteCond %{QUERY_STRING} (absolute_|base|root_)(dir|path)(=|%3d)(ftp|https?) [NC,OR]
RewriteCond %{QUERY_STRING} (s)?(ftp|inurl|php)(s)?(:(/|%2f|%u2215)(/|%2f|%u2215)) [NC,OR]
RewriteCond %{QUERY_STRING} (\.|20)(get|the)(_|%5f)(permalink|posts_page_url)(\(|%28) [NC,OR]
RewriteCond %{QUERY_STRING} ((boot|win)((\.|%2e)ini)|etc(/|%2f)passwd|self(/|%2f)environ) [NC,OR]
RewriteCond %{QUERY_STRING} (((/|%2f){3,3})|((\.|%2e){3,3})|((\.|%2e){2,2})(/|%2f|%u2215)) [NC,OR]
RewriteCond %{QUERY_STRING} (benchmark|char|exec|fopen|function|html)(.*)(\(|%28)(.*)(\)|%29) [NC,OR]
RewriteCond %{QUERY_STRING} (php)([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}) [NC,OR]
RewriteCond %{QUERY_STRING} (e|%65|%45)(v|%76|%56)(a|%61|%31)(l|%6c|%4c)(.*)(\(|%28)(.*)(\)|%29) [NC,OR]
RewriteCond %{QUERY_STRING} (/|%2f)(=|%3d|$&|_mm|cgi(\.|-)|inurl(:|%3a)(/|%2f)|(mod|path)(=|%3d)(\.|%2e)) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3c)(.*)(e|%65|%45)(m|%6d|%4d)(b|%62|%42)(e|%65|%45)(d|%64|%44)(.*)(>|%3e) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3c)(.*)(i|%69|%49)(f|%66|%46)(r|%72|%52)(a|%61|%41)(m|%6d|%4d)(e|%65|%45)(.*)(>|%3e) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3c)(.*)(o|%4f|%6f)(b|%62|%42)(j|%4a|%6a)(e|%65|%45)(c|%63|%43)(t|%74|%54)(.*)(>|%3e) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3c)(.*)(s|%73|%53)(c|%63|%43)(r|%72|%52)(i|%69|%49)(p|%70|%50)(t|%74|%54)(.*)(>|%3e) [NC,OR]
RewriteCond %{QUERY_STRING} (\+|%2b|%20)(d|%64|%44)(e|%65|%45)(l|%6c|%4c)(e|%65|%45)(t|%74|%54)(e|%65|%45)(\+|%2b|%20) [NC,OR]
RewriteCond %{QUERY_STRING} (\+|%2b|%20)(i|%69|%49)(n|%6e|%4e)(s|%73|%53)(e|%65|%45)(r|%72|%52)(t|%74|%54)(\+|%2b|%20) [NC,OR]
RewriteCond %{QUERY_STRING} (\+|%2b|%20)(s|%73|%53)(e|%65|%45)(l|%6c|%4c)(e|%65|%45)(c|%63|%43)(t|%74|%54)(\+|%2b|%20) [NC,OR]
RewriteCond %{QUERY_STRING} (\+|%2b|%20)(u|%75|%55)(p|%70|%50)(d|%64|%44)(a|%61|%41)(t|%74|%54)(e|%65|%45)(\+|%2b|%20) [NC,OR]
RewriteCond %{QUERY_STRING} (\\x00|(\"|%22|\'|%27)?0(\"|%22|\'|%27)?(=|%3d)(\"|%22|\'|%27)?0|cast(\(|%28)0x|or%201(=|%3d)1) [NC,OR]
RewriteCond %{QUERY_STRING} (g|%67|%47)(l|%6c|%4c)(o|%6f|%4f)(b|%62|%42)(a|%61|%41)(l|%6c|%4c)(s|%73|%53)(=|\[|%[0-9A-Z]{0,2}) [NC,OR]
RewriteCond %{QUERY_STRING} (_|%5f)(r|%72|%52)(e|%65|%45)(q|%71|%51)(u|%75|%55)(e|%65|%45)(s|%73|%53)(t|%74|%54)(=|\[|%[0-9A-Z]{2,}) [NC,OR]
RewriteCond %{QUERY_STRING} (j|%6a|%4a)(a|%61|%41)(v|%76|%56)(a|%61|%31)(s|%73|%53)(c|%63|%43)(r|%72|%52)(i|%69|%49)(p|%70|%50)(t|%74|%54)(:|%3a)(.*)(;|%3b|\)|%29) [NC,OR]
RewriteCond %{QUERY_STRING} (b|%62|%42)(a|%61|%41)(s|%73|%53)(e|%65|%45)(6|%36)(4|%34)(_|%5f)(e|%65|%45|d|%64|%44)(e|%65|%45|n|%6e|%4e)(c|%63|%43)(o|%6f|%4f)(d|%64|%44)(e|%65|%45)(.*)(\()(.*)(\)) [NC,OR]
RewriteCond %{QUERY_STRING} (@copy|\$_(files|get|post)|allow_url_(fopen|include)|auto_prepend_file|blexbot|browsersploit|(c99|php)shell|curl(_exec|test)|disable_functions?|document_root|elastix|encodeuricom|exploit|fclose|fgets|file_put_contents|fputs|fsbuff|fsockopen|gethostbyname|grablogin|hmei7|input_file|open_basedir|outfile|passthru|phpinfo|popen|proc_open|quickbrute|remoteview|root_path|safe_mode|shell_exec|site((.){0,2})copier|sux0r|trojan|user_func_array|wget|xertive) [NC,OR]
RewriteCond %{QUERY_STRING} (;|<|>|\'|\"|\)|%0a|%0d|%22|%27|%3c|%3e|%00)(.*)(/\*|alter|base64|benchmark|cast|concat|convert|create|encode|declare|delete|drop|insert|md5|request|script|select|set|union|update) [NC,OR]
RewriteCond %{QUERY_STRING} ((\+|%2b)(concat|delete|get|select|union)(\+|%2b)) [NC,OR]
RewriteCond %{QUERY_STRING} (union)(.*)(select)(.*)(\(|%28) [NC,OR]
RewriteCond %{QUERY_STRING} (concat|eval)(.*)(\(|%28) [NC]

	#RewriteRule .* - [F,L]

    RewriteRule .* /7G_log.php?log [END,NE,E=7G_QUERY_STRING:%1___%2___%3]

</IfModule>

Is this something you could please look in to? I’ve tested with 8G Firewall (currently in beta) and the same issue occurs. Thanks for looking.