Ticket #28564: miqro-28564.2.patch

src/wp-includes/formatting.php

@@ -203 +203 @@
                 . '|'
                 .       '\['            // Find start of shortcode.
                 .       '\[?'           // Shortcodes may begin with [[
-                .       '[^\[\]<>]+'    // Shortcodes do not contain other shortcodes or HTML elements.
+                .       '[^\[\]]+'      // Shortcodes do not contain other shortcodes.  HTML recursion is permitted, but not texturized.
                 .       '\]'            // Find end of shortcode.
                 .       '\]?'           // Shortcodes may end with ]]
                 . ')/s';
@@ -220 +220 @@
                                 _wptexturize_pushpop_element( $curl, $no_texturize_tags_stack, $no_texturize_tags, '<', '>' );
                         }
 
-                } elseif ( '[' === $first && 1 === preg_match( '/^\[[^\[\]<>]+\]$/', $curl ) ) {
+                } elseif ( '[' === $first && 1 === preg_match( '/^\[[^\[\]]+\]$/', $curl ) ) {
                         // This is a shortcode delimeter.
 
                         _wptexturize_pushpop_element( $curl, $no_texturize_shortcodes_stack, $no_texturize_shortcodes, '[', ']' );
 
-                } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?[^\[\]<>]+\]\]?$/', $curl ) ) {
+                } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?[^\[\]]+\]\]?$/', $curl ) ) {
                         // This is an escaped shortcode delimeter.
 
                         // Do not texturize.

tests/phpunit/tests/formatting/WPTexturize.php

@@ -1146 +1146 @@
         function data_tag_avoidance() {
                 return array(
                         array(
+                                '[ is it wise to <a title="allow user content ] here? hmm"> maybe </a> ]',
+                                '[ is it wise to <a title="allow user content ] here? hmm&#8221;> maybe </a> ]',
+                        ),
+                        array(
                                 '[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy </a> ]',
                                 '[ photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy </a> ]',
                         ),
@@ -1186 +1190 @@
                                 '[code]...[/code]]...', // This test would not pass in 3.9 because the extra brace was always ignored by texturize.
                         ),
                         array(
+                                '[gal>ery ...]', // This is a potentially usable shortcode.
                                 '[gal>ery ...]',
-                                '[gal>ery &#8230;]',
                         ),
                         array(
                                 '[gallery ...',
@@ -1194 +1198 @@
                                 '[gallery &#8230;',
                         ),
                         array(
+                                '[gallery <br ... /> ...]', // This tag is still valid. Shortcode 'attributes' are not considered in the initial parsing of shortcodes, and HTML is allowed.
                                 '[gallery <br ... /> ...]',
-                                '[gallery <br ... /> &#8230;]',
                         ),
                         array(
                                 '<br [gallery ...] ... />',
@@ -1234 +1238 @@
                                 '[/gallery ...]]',
                         ),
                         array(
+                                '[[gallery <br ... /> ...]]', // This gets parsed as an escaped shortcode with embedded HTML.  Brains may explode.
                                 '[[gallery <br ... /> ...]]',
-                                '[[gallery <br ... /> &#8230;]]',
                         ),
                         array(
                                 '<br [[gallery ...]] ... />',