Changeset 28773

Timestamp:

06/18/2014 07:48:46 PM (10 years ago)

Author:

wonderboymusic

Message:

In wptexturize() + tests:

• Allow well-formed HTML inside of shortcode attributes
• Restrict recursion. HTML is allowed but ignored.
• Do not allow exotic HTML comments in shortcode attributes.
• Continue to ignore the [ and ] chars if they appear in any HTML attribute.
• Update related regex patterns.
• Update unit tests.

Props miqrogroove.
Fixes #28564.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (2 diffs)
• tests/phpunit/tests/formatting/WPTexturize.php (modified) (3 diffs)

trunk/src/wp-includes/formatting.php

@@ -204 +204 @@
         .   '\['        // Find start of shortcode.
         .   '\[?'       // Shortcodes may begin with [[
-        .   '[^\[\]<>]+'    // Shortcodes do not contain other shortcodes or HTML elements.
+        .   '(?:'
+        .       '[^\[\]<>]' // Shortcodes do not contain other shortcodes.
+        .   '|'
+        .       '<.+?>' // HTML elements permitted. Prevents matching ] before >.
+        .   ')+'
         .   '\]'        // Find end of shortcode.
         .   '\]?'       // Shortcodes may end with ]]
@@ -221 +225 @@
             }
 
-        } elseif ( '[' === $first && 1 === preg_match( '/^\[[^\[\]<>]+\]$/', $curl ) ) {
+        } elseif ( '[' === $first && 1 === preg_match( '/^\[(?:[^\[\]<>]|<.+?>)+\]$/', $curl ) ) {
             // This is a shortcode delimeter.
 
             _wptexturize_pushpop_element( $curl, $no_texturize_shortcodes_stack, $no_texturize_shortcodes, '[', ']' );
 
-        } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?[^\[\]<>]+\]\]?$/', $curl ) ) {
+        } elseif ( '[' === $first && 1 === preg_match( '/^\[\[?(?:[^\[\]<>]|<.+?>)+\]\]?$/', $curl ) ) {
             // This is an escaped shortcode delimeter.
 

trunk/tests/phpunit/tests/formatting/WPTexturize.php

@@ -1147 +1147 @@
         return array(
             array(
+                '[ is it wise to <a title="allow user content ] here? hmm"> maybe </a> ]',
+                '[ is it wise to <a title="allow user content ] here? hmm"> maybe </a> ]',
+            ),
+            array(
                 '[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy </a> ]',
                 '[ photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy </a> ]',
@@ -1195 +1199 @@
             ),
             array(
+                '[gallery <br ... /> ...]', // This tag is still valid. Shortcode 'attributes' are not considered in the initial parsing of shortcodes, and HTML is allowed.
                 '[gallery <br ... /> ...]',
-                '[gallery <br ... /> &#8230;]',
             ),
             array(
@@ -1235 +1239 @@
             ),
             array(
+                '[[gallery <br ... /> ...]]', // This gets parsed as an escaped shortcode with embedded HTML.  Brains may explode.
                 '[[gallery <br ... /> ...]]',
-                '[[gallery <br ... /> &#8230;]]',
             ),
             array(