Ticket #33134: 33134.patch

src/wp-includes/shortcodes.php

@@ -421 +421 @@
                 preg_match('%[a-zA-Z0-9]+%', $front, $matches);
                 $elname = $matches[0];
 
+                // Do pre-check to see if any unfiltered_html type attributes.
+                foreach ( $attributes as &$attr ) {
+                        $double = strpos( $attr, '"' );
+                        $single = strpos( $attr, "'" );
+                        if ( false === $double && false === $single ) {
+                                continue 2; // Go to next element.
+                        }
+                        $open = strpos( $attr, '[' );
+                        $close = strpos( $attr, ']' );
+                        if ( false === $open || false === $close ) {
+                                continue; // Go to next attribute.
+                        }
+                        if ( ( false === $single || $open < $single ) && ( false === $double || $open < $double ) ) {
+                                continue 2; // Go to next element.
+                        }
+                }
+
                 // Look for shortcodes in each attribute separately.
                 foreach ( $attributes as &$attr ) {
                         $open = strpos( $attr, '[' );

tests/phpunit/tests/shortcode.php

@@ -4 +4 @@
  */
 class Tests_Shortcode extends WP_UnitTestCase {
 
-        protected $shortcodes = array( 'test-shortcode-tag', 'footag', 'bartag', 'baztag', 'dumptag', 'hyphen', 'hyphen-foo', 'hyphen-foo-bar', 'url', 'img' );
+        protected $shortcodes = array( 'test-shortcode-tag', 'footag', 'bartag', 'baztag', 'dumptag', 'hyphen', 'hyphen-foo', 'hyphen-foo-bar', 'url', 'img', 'state_inc', 'state_val' );
 
         function setUp() {
                 parent::setUp();
@@ -88 +88 @@
                 return $out;
         }
 
+        protected $state = 0;
+
+        function _shortcode_state_inc( $atts, $content ) {
+                $this->state++;
+                return do_shortcode( $content );
+        }
+
+        function _shortcode_state_val( $atts, $content ) {
+                return $this->state;
+        }
+
         function test_noatts() {
                 do_shortcode('[test-shortcode-tag /]');
                 $this->assertEquals( '', $this->atts );
@@ -840 +851 @@
                 );
                 return wp_json_encode( $arr );
         }
+
+        /**
+         * @ticket 33134
+         */
+        function test_nested_left_to_right() {
+                // Now treated as unfiltered.
+                $content = '<a [state_val]>[state_val]</a>';
+                $this->assertEquals( '<a 0>0</a>', do_shortcode( $content ) );
+                $content = '[state_inc]<a [state_val]>[state_val]</a>[/state_inc]';
+                $this->assertEquals( '<a 1>1</a>', do_shortcode( $content ) );
+                // Quoted attributes with dummy workaround (indicates unfiltered_html).
+                $content = '[state_inc]<a dummy href="[state_val]">[state_val]</a>[/state_inc]';
+                $this->assertEquals( '<a dummy href="2">2</a>', do_shortcode( $content ) );
+                // Quoted attributes without workaround leading to current filtered behaviour.
+                $content = '[state_inc]<a href="[state_val]">[state_val]</a>[/state_inc]';
+                $this->assertEquals( '<a href="2">3</a>', do_shortcode( $content ) ); // Note this should have href="3".
+        }
 }