Ticket #33106: 33106.5.patch

src/wp-includes/class-wp-embed.php

@@ -318 +318 @@
          * @return string Potentially modified $content.
          */
         public function autoembed( $content ) {
-                // Strip newlines from all elements.
-                $content = wp_replace_in_html_tags( $content, array( "\n" => " " ) );
+                // Avoid multiline elements and comments.
+                $content = wp_html_split( $content );
+                for ( $i = 0, $c = count( $content ); $i < $c; $i += 2 ) { 
 
-                // Find URLs that are on their own line.
-                return preg_replace_callback( '|^(\s*)(https?://[^\s"]+)(\s*)$|im', array( $this, 'autoembed_callback' ), $content );
+                        if ( '' == $content[$i] || false === strpos( $content[$i], 'http' ) ) {
+                                continue;
+                        }
+
+                        // Find URLs that are on their own line.
+                        $content[$i] = preg_replace_callback( '|^(\s*)(https?://[^\s"]+)(\s*)$|im', array( $this, 'autoembed_callback' ), $content[$i] );
+
+                }
+
+                return implode( $content );
         }
 
         /**

src/wp-includes/formatting.php

@@ -504 +504 @@
         // Standardize newline characters to "\n".
         $pee = str_replace(array("\r\n", "\r"), "\n", $pee);
 
-        // Strip newlines from all elements.
-        $pee = wp_replace_in_html_tags( $pee, array( "\n" => " " ) );
+        // Find newlines in all elements and add placeholders.
+        $pee = wp_replace_in_html_tags( $pee, array( "\n" => " <!-- wpnl --> " ) );
 
         // Collapse line breaks before and after <option> elements so they don't get autop'd.
         if ( strpos( $pee, '<option' ) !== false ) {
@@ -592 +592 @@
         if ( !empty($pre_tags) )
                 $pee = str_replace(array_keys($pre_tags), array_values($pre_tags), $pee);
 
+        // Restore newlines in all elements.
+        $pee = str_replace( " <!-- wpnl --> ", "\n", $pee );
+
         return $pee;
 }
 
 /**
- * Replace characters or phrases within HTML elements only.
+ * Separate HTML elements and comments from the text.
  *
- * @since 4.2.3
+ * @since 4.2.4
  *
- * @param string $haystack The text which has to be formatted.
- * @param array $replace_pairs In the form array('from' => 'to', ...).
- * @return string The formatted text.
+ * @param string $input The text which has to be formatted.
+ * @return array The formatted text.
  */
-function wp_replace_in_html_tags( $haystack, $replace_pairs ) {
+function wp_html_split( $input ) {
         // Find all elements.
         $comments =
                   '!'           // Start of comment, after the <.
@@ -614 +616 @@
                 . ')*+'         // Loop possessively.
                 . '(?:-->)?';   // End of comment. If not found, match all input.
 
+        $cdata =
+                  '!\[CDATA\['  // Start of comment, after the <.
+                . '[^\]]*+'     // Consume non-].
+                . '(?:'         // Unroll the loop: Consume everything until ]]> is found.
+                .     '](?!]>)' // One ] not followed by end of comment.
+                .     '[^\]]*+' // Consume non-].
+                . ')*+'         // Loop possessively.
+                . '(?:]]>)?';   // End of comment. If not found, match all input.
+
         $regex =
                   '/('              // Capture the entire match.
                 .     '<'           // Find start of element.
@@ -620 +631 @@
                 .     '(?(?=!--)'   // Is this a comment?
                 .         $comments // Find end of comment.
                 .     '|'
-                .         '[^>]*>?' // Find end of element. If not found, match all input.
+                .         '(?(?=!\[CDATA\[)' // Is this a comment?
+                .             $cdata // Find end of comment.
+                .         '|'
+                .             '[^>]*>?' // Find end of element. If not found, match all input.
+                .         ')'
                 .     ')'
                 . ')/s';
 
-        $textarr = preg_split( $regex, $haystack, -1, PREG_SPLIT_DELIM_CAPTURE );
+        return preg_split( $regex, $input, -1, PREG_SPLIT_DELIM_CAPTURE );
+}
+
+/**
+ * Replace characters or phrases within HTML elements only.
+ *
+ * @since 4.2.3
+ *
+ * @param string $haystack The text which has to be formatted.
+ * @param array $replace_pairs In the form array('from' => 'to', ...).
+ * @return string The formatted text.
+ */
+function wp_replace_in_html_tags( $haystack, $replace_pairs ) {
+        // Find all elements.
+        $textarr = wp_html_split( $haystack );
         $changed = false;
 
         // Optimize when searching for one item.

tests/phpunit/tests/formatting/Autop.php

@@ -399 +399 @@
 
                 $this->assertEquals( $expected, trim( wpautop( $content ) ) );
         }
+
+        /**
+         * Do not allow newlines within HTML elements to become mangled.
+         *
+         * @ticket 33106
+         * @dataProvider data_element_sanity
+         */
+        function test_element_sanity( $input, $output ) {
+                return $this->assertEquals( $output, wpautop( $input ) );
+        }
+
+        function data_element_sanity() {
+                return array(
+                        array(
+                                "Hello <a\nhref='world'>",
+                                "<p>Hello <a\nhref='world'></p>\n",
+                        ),
+                        array(
+                                "Hello <!-- a\nhref='world' -->",
+                                "<p>Hello <!-- a\nhref='world' --></p>\n",
+                        ),
+/* Block elements inside comments will fail this test in all versions, it's not a regression.
+                        array(
+                                "Hello <!-- <hr> a\nhref='world' -->",
+                                "<p>Hello <!-- <hr> a\nhref='world' --></p>\n",
+                        ),
+                        array(
+                                "Hello <![CDATA[ <hr> a\nhttps://youtu.be/jgz0uSaOZbE\n ]]>",
+                                "<p>Hello <![CDATA[ <hr> a\nhttps://youtu.be/jgz0uSaOZbE\n ]]></p>\n",
+                        ),
+*/
+                        array(
+                                "Hello <![CDATA[ a\nhttps://youtu.be/jgz0uSaOZbE\n ]]>",
+                                "<p>Hello <![CDATA[ a\nhttps://youtu.be/jgz0uSaOZbE\n ]]></p>\n",
+                        ),
+                        array(
+                                "Hello <![CDATA[ <!-- a\nhttps://youtu.be/jgz0uSaOZbE\n a\n9 ]]> -->",
+                                "<p>Hello <![CDATA[ <!-- a\nhttps://youtu.be/jgz0uSaOZbE\n a\n9 ]]> --></p>\n",
+                        ),
+                        array(
+                                "Hello <![CDATA[ <!-- a\nhttps://youtu.be/jgz0uSaOZbE\n a\n9 --> a\n9 ]]>",
+                                "<p>Hello <![CDATA[ <!-- a\nhttps://youtu.be/jgz0uSaOZbE\n a\n9 --> a\n9 ]]></p>\n",
+                        ),
+                );
+        }
+        
 }