Ticket #22625: 22625.patch

src/wp-includes/formatting.php

@@ -1794 +1794 @@
         // WP bug fix for LOVE <3 (and other situations with '<' before a number)
         $text = preg_replace('#<([0-9]{1})#', '&lt;$1', $text);
 
-        while ( preg_match("/<(\/?[\w:]*)\s*([^>]*)>/", $text, $regex) ) {
+        while ( preg_match("/<(\/?[\w:]+)\s*([^>]*)>/", $text, $regex) ) {
                 $newtext .= $tagqueue;
 
                 $i = strpos($text, $regex[0]);
@@ -1871 +1871 @@
                                 $tag = '';
                         }
                 }
-                $newtext .= substr($text, 0, $i) . $tag;
+                $newtext .= str_replace( '<', '&lt;', substr($text, 0, $i)) . $tag;
                 $text = substr($text, $i + $l);
         }
 
@@ -1879 +1879 @@
         $newtext .= $tagqueue;
 
         // Add Remaining text
-        $newtext .= $text;
+        $newtext .= str_replace( '<', '&lt;', $text );
 
         // Empty Stack
         while( $x = array_pop($tagstack) )

tests/phpunit/tests/formatting/balanceTags.php

@@ -204 +204 @@
                 }
         }
 
+        /**
+         * @ticket 22625
+         **/
+
+        function test_encodes_lone_anglebracket() {
+                $inputs = array(
+                    'This is < That. <blockquote>foo</blockquote> Text <a href="#">link</a>. Post-link text.',
+                    'This is <blockquote>foo</blockquote> < that.',
+                    'This is <blockquote>foo < bar</blockquote> that.',
+                    '< blockquote > < foo < blockquote >',
+                    'This is <blockquote>foo < < < bar</blockquote> that.',
+                    '<<blockquote>foo<</blockquote><',
+                    '<p>I <3 WordPress',
+                    '<3<div>foo',
+                );
+                $expected = array(
+                    'This is &lt; That. <blockquote>foo</blockquote> Text <a href="#">link</a>. Post-link text.',
+                    'This is <blockquote>foo</blockquote> &lt; that.',
+                    'This is <blockquote>foo &lt; bar</blockquote> that.',
+                    '&lt; blockquote > &lt; foo &lt; blockquote >',
+                    'This is <blockquote>foo &lt; &lt; &lt; bar</blockquote> that.',
+                    '&lt;<blockquote>foo&lt;</blockquote>&lt;',
+                    '<p>I &lt;3 WordPress</p>',
+                    '&lt;3<div>foo</div>',
+                );
+
+                foreach ( $inputs as $key => $input ) {
+                        $this->assertEquals( $expected[$key], balanceTags( $inputs[$key], true ) );
+                }
+        }
 }