Ticket #48011: 48011-3.diff

src/wp-includes/nav-menu.php

@@ -491 +491 @@
                         }
                 }
 
-                if ( $args['menu-item-title'] == $original_title ) {
+                if ( wp_unslash( $args['menu-item-title'] ) == wp_specialchars_decode( $original_title ) ) {
                         $args['menu-item-title'] = '';
                 }
 

tests/phpunit/tests/post/nav-menu.php

@@ -956 +956 @@
                 );
         }
 
+        /**
+         * Tests `wp_update_nav_menu_item()` with special characters in a category name.
+         *
+         * When inserting a category as a nav item, the `$args['menu-item-title']` should
+         * always be empty as it should get the title from the category object itself.
+         *
+         * @ticket 48011
+         */
+        function test_wp_update_nav_menu_item_with_special_character_in_categories() {
+
+                $category_name = 'Test Cat - \"Pre-Slashed\" Cat Name & >';
+
+                $cat = self::factory()->category->create_and_get(
+                        array(
+                                'name' => $category_name,
+                        )
+                );
+
+                add_action( 'wp_update_nav_menu_item', array( $this, '_callback_wp_update_nav_menu_item_48011' ), 10, 3 );
+
+                $id = wp_update_nav_menu_item(
+                        $this->menu_id,
+                        0,
+                        array(
+                                'menu-item-type'      => 'taxonomy',
+                                'menu-item-object'    => 'category',
+                                'menu-item-object-id' => $cat->term_id,
+                                'menu-item-status'    => 'publish',
+                                'menu-item-title'     => $category_name,    // Interesting enough, if we use `$cat->name` we won't be able to
+                                                                                                                        // replicate the bug because it's in htmlentities form.
+                        )
+                );
+        }
+
+        /**
+         * Callback for the `wp_update_nav_menu_item` action.
+         *
+         * @since 5.4.0
+         */
+        function _callback_wp_update_nav_menu_item_48011( $menu_id, $menu_item_db_id, $args ) {
+                $this->assertEmpty( $args['menu-item-title'] );
+        }
 }