Changeset 36036

Timestamp:

12/21/2015 02:42:30 AM (11 years ago)

Author:

pento

Message:

Texturize: Transform & into & in tag attributes.

[35709] was overly broad, and stopped transforming & characters within tag attributes. So that sites aren't generating invalid HTML, we need to restore this functionality, while continuing to not transform & within blocked tags.

Fixes #35008 for trunk.

Location:

trunk

Files:

• src/wp-includes/formatting.php (modified) (1 diff)
• tests/phpunit/tests/formatting/WPTexturize.php (modified) (2 diffs)

trunk/src/wp-includes/formatting.php

@@ -234 +234 @@
                         } else {
                                 // This is an HTML element delimiter.
+
+                                // Replace each & with & unless it already looks like an entity.
+                                $curl = preg_replace( '/&(?!#(?:\d+|x[a-f0-9]+);|[a-z1-4]{1,8};)/i', '&', $curl );
+
                                 _wptexturize_pushpop_element( $curl, $no_texturize_tags_stack, $no_texturize_tags );
                         }

trunk/tests/phpunit/tests/formatting/WPTexturize.php

@@ -11 +11 @@
 
         function test_disable() {
-                $this->assertEquals('<pre>---</pre>', wptexturize('<pre>---</pre>'));
-                $this->assertEquals('<pre><code></code>--</pre>', wptexturize('<pre><code></code>--</pre>'));
-
-                $this->assertEquals( '<code>---</code>',     wptexturize( '<code>---</code>'     ) );
-                $this->assertEquals( '<kbd>---</kbd>',       wptexturize( '<kbd>---</kbd>'       ) );
-                $this->assertEquals( '<style>---</style>',   wptexturize( '<style>---</style>'   ) );
-                $this->assertEquals( '<script>---</script>', wptexturize( '<script>---</script>' ) );
-                $this->assertEquals( '<tt>---</tt>',         wptexturize( '<tt>---</tt>'         ) );
+                $this->assertEquals('<pre>---&</pre>', wptexturize('<pre>---&</pre>'));
+                $this->assertEquals('<pre><code></code>--&</pre>', wptexturize('<pre><code></code>--&</pre>'));
+
+                $this->assertEquals( '<code>---&</code>',     wptexturize( '<code>---&</code>'     ) );
+                $this->assertEquals( '<kbd>---&</kbd>',       wptexturize( '<kbd>---&</kbd>'       ) );
+                $this->assertEquals( '<style>---&</style>',   wptexturize( '<style>---&</style>'   ) );
+                $this->assertEquals( '<script>---&</script>', wptexturize( '<script>---&</script>' ) );
+                $this->assertEquals( '<tt>---&</tt>',         wptexturize( '<tt>---&</tt>'         ) );
 
                 $this->assertEquals('<code>href="baba"</code> &#8220;baba&#8221;', wptexturize('<code>href="baba"</code> "baba"'));
@@ -1269 +1269 @@
                         array(
                                 '[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy & that guy </a> ]',
-                                '[ photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy &#038; that guy </a> ]',
+                                '[ photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy &#038; that guy </a> ]',
                         ),
                         array(
                                 '[photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy & that guy </a>]',
-                                '[photos by <a href="http://example.com/?a[]=1&a[]=2"> this guy &#038; that guy </a>]',
+                                '[photos by <a href="http://example.com/?a[]=1&#038;a[]=2"> this guy &#038; that guy </a>]',
+                        ),
+                        array(
+                                '& <script>&&</script>',
+                                '&#038; <script>&&</script>'
                         ),
                         array(